Introduction to Networking & NTP

Transcription

1 Introduction to Networking & NTP

2 Agenda Basic Network Elements Time Transfer Basics How time is transferred Accuracy limitations Test data review Live demo Typical Time Distribution Strategies Time hierarchies Peering Example networks The simplicity of configuration

3 The OSI Model Open Systems Interconnect (OSI) Reference Model Divides network communications into seven layers Each step corresponds to a step in the network transmission process Notes: First, you need rules to build a network by, this is known as the OSI Model. Those of you who know this model may be groaning, because it s like beginning with the heaviest thing. We ll talk about little pieces. The Open Systems Interconnect Reference Model describes how network transactions occur. How applications interface with the network stack (the OSI model is the network stack), all the way from bits and bytes to your browser. It divides communications into seven layers, each layer corresponds to a step in getting data across the network.

4 OSI Layers (a.k.a. the Stack ) 7. Application Layer: Interface between program applications and the network 6. Presentation Layer: reformats data to and from layers 7 and 4. Handles compression and encryption. 5. Session Layer: maintains connection between sender and receivers, handles security issues 4.Transport Layer: creates & sequences packets, handles retransmissions 3. Network Layer: defines logical addresses (router level) 2. Data Link Layer: groups data into frames 1. Physical Layer: translates bits into signals (switch & hub level) Notes: The stack is composed of these 7 layers. In the old days we used to talk about these layers as if they were more mysterious. Now it s built into everything from your phone, to application software. We won t focus on every layer. The application layer is important because it interfaces between the program UI and the network. The Physical layer is the ones and zeroes. It s literally your cable connecting to the back of the computer. In the world of network time transfer (NTP) we focus on layers 1-3, and since NTP is a protocol we interface with applications like SymmTime. Our activities today will focus on the transport layer and below. Switches and hubs operate at the physical layer. Routers operate at the network layer.

5 Basic Network NOTES: A crossover cable is as basic as a network gets. However, if I was to connect my computer to yours through a crossover cable, it would work just like the most elaborate LAN although it s not a particularly useful model unless you are trying to transfer data from one computer to the other.

6 Figurative Network Notes: As we add more elements, we get more complex collection of cables. Each computer on a LAN is directly connected to every other computer. If I want to add another computer, I need to add exponentially more connections. If I want to add another PC and a server, the connections now grow from 1 to 3 to 6. In this basic model, whenever any computer wants to send a message, the message goes out to all the other computers. You can imagine what happens when all of them want to send a message at about the same time. It can get unwieldy very quickly.

7 Concentrating Nodes Notes: So to simplify things, we move to a hub. You can find them at the computer store for 20 dollars. The hub aggregates all the cable connections into a common box. This works at the physical layer. With the hub, as with the direct connection model, all nodes see all traffic. This can lead to collisions. A hub does not add latency to NTP time traffic delivery.

8 Expanding the Network Notes: If you want to expand to the network, just add more hubs. It simplifies the layout of an extensive physical network. Hubs can be located near natural clusters of computers, and a single long cable can be used to link the hubs. However, the traffic problem will be more pronounced as a hub-only network grows. You start getting packet collisions when computers simultaneously try to send packets. When a computer sends a packet, it will temporarily abandon the transfer if it senses traffic on the line. If there are too many computers on the network, and if they re all backing off a random amount of time then trying to resend their packet, the number of collisions will grow dramatically (this generally happens above 40% utilization of the network capacity). IT administrators generally like to run between 25% and 40% network utilization. In high-speed military applications (real-time, mission-critical systems), they don t like to get above 20% utilization.

9 Improving Efficiency Switches: read physical (MAC) destination address and direct each packet to appropriate machine or subnet. Gradually replacing hubs No impact on NTP accuracy A subnet (short for subnetwork ) is an identifiably separate part of an organization s network. Typically, a subnet may represent all the machines at one geographic location or on the same local area network (LAN). Having an network divided into subnets allows it to be connected to the Internet with a single shared network address. Notes: Switches read the unique physical address (Ethernet MAC address) of every computer connected to it, and keeps track of it. The connection occurs at the physical layer. Switches do what their name describes when data comes in that is bound for a device on its MAC address list, it switches the packet to that device. The switching occurs with little latency (300ms for example). Switches do not noticeably degrade NTP accuracy. The advantage of switches is that they reduce the number of collisions on the line. Data is directed more purposefully. As the price of switches drops, hubs are rapidly being replaced in network infrastructure. Another driver of switch use is the growth of VoIP an application where data collision will compromise real-time communication. Switches also allow you to create subnets and divide your network into manageable segments.

10 Isolating Subnets Routers have physical addresses on each subnet. Uses a router table to direct traffic to destinations located outside subnet based on logical addresses (Layer 3, IP addresses). Can have a substantial impact on NTP accuracy due to buffering of data (store & forward) Notes: We now introduce routers many of us use routers at home to buffer and distribute our high-speed internet connections to computers within our homes. Routers have a physical address on each subnet. At home, the router has a physical address on your home network. The router also provides an address to your ISP. That way the router can participate in both subnets. This is done because there a finite number of IP (Internet Protocol) addresses far fewer than the number of computers. Subnets allow us to reuse and allocate the addresses as needed (in this case, assigned by the ISP). A router uses a router table to direct traffic. If a switch fails to direct traffic, it sends it to the router (like sending a letter to the post office). The router forwards the packet to the another router toward the destination. Routers are packet buffering devices and can have a significant device on NTP accuracy. The latency can be significant and unpredictable. Interesting note: What happens when the router buffer fills? That s right, it just throws the packets away. That s why we have TCP/IP (Transmission Control Protocol over Internet Protocol) to make sure that packets still get sent, even if the router dumps them.

11 Internetworking Notes: Our network s starting to get more complex. All the traffic gets shared among Hubs. Switches decide if it recognizes any of the destinations. If not, the switch sends it to the Gateway Address (the router s address). Then the router decides how to send the data on.

12 TTM Network Notes: Here s an example of the Symmetricom TT&M network. It was built in 2000 when switches were expensive so hubs are more common. There are hubs in every part of the building. An from 1st floor West gets seen by every computer on the floor. If it gets sent to another group, a switch transfers it to the mail server. The switches eliminate collisions between the data in different regions of the building. Production has its own subnet, placed behind a router. NTP servers are tested there. The router isolates the development group from the corporate network and also prevents experimental devices from taking down or slowing the network. The R&D lab is also behind a router (as a result of a blaster test flooding the entire network with packets). Also behind the primary switch are servers, license servers, time servers, data servers, etc.). Santa Rosa is connected to San Jose by dual T1 lines (each routed along different sides of San Francisco Bay). They connect to a router in San Jose and a switch to provide mutual protection. From San Jose, we connect to a firewall, then the DMZ (the area where ntp1.symmetricom.com exist and can be subject to computer hacks), and then through a final router to the Internet.

13 LAN vs WAN Speeds LAN Speeds (Ethernet most common) 10 Mbps (10BaseT) 100 Mbps (100BaseT) 1000 Mbps (Gigabit Ethernet, 1000BaseT) High speed, low latency devices Equipment: Hubs & Switches WAN Speeds Built on telecom infrastructure and widely populated with routers. Equipment: modems, routers DSL: 3 Mbps tops, typically 768 Kbps depending on distance from central office. Lower speed, higher latency devices Cable: 1-3 Mbps T1 (most common enterprise digital connection): Mbps Notes: Bottom Line: LANs are blazingly fast. WANs are not. Not only do WAN connections have narrower pipes, but there are many routers on WANS introducing latencies to the network.

14 Time Transfer Basics

15 The Toaster Analogy Time servers are network toasters. Without bread there is no toast, likewise without time clients requesting the time there is no network synchronization. Notes: The benefit of synchronization takes place at the client. Without the time client, there is no synchronization between computers.

16 How Time is Transferred with NTP Assumes symmetric path latency for outbound and return paths Notes: NTP is a client-originated protocol. The client originates the time transfer process. A small (60-90 bytes) packet is created. The client adds its own time stamp (Originate Time Stamp) and sends it to the server. The instant the server gets the packet, it time stamps it (Receive Time Stamp). That packet can sit with the server a bit. The time server does not have to replay instantaneously. Then the server adds another time stamp (Transmit Time Stamp) and sends it back to the client. The time the client receives the packet along with the three packet time stamps is used to calculate the Client Time Offset. The client clock is then adjusted by the offset. One assumption: This assumes that the network latency is symmetric on both the path to and from the time server. On a LAN this may be relatively true because LANs tend to be very fast. However, an Internet-based transaction may use different router-buffered paths. Over a LAN, the synch may be accuracy between 1-2 ms. In a WAN, the swing could be as great as 1-30 ms.

17 NTP Time Transfer Limitations Notes: Let s look at delay. The stack delay might be on the order of microseconds at each end. The majority occurs on the transit data path. Also, NTP is often not a priority task in the operating system which can cause further delay. The primary contributor to an inaccurate clock offset error correction though will be the asymmetric network delays. These delays are worse when time is being retrieved over the Internet.

18 Contributors to Time Offsets From Time Servers IP stack delays ~ low milliseconds, 100 s of microseconds Routers ~10 s to 100 s of milliseconds Buffer delays Asymmetrical path latency Client computer oscillator drift Infrequent client clock updates Notes: Again, IP stack delay is minimal, and the routers can add significant (and asymmetric) latency. You can also contribute to the error by having a client clock that drifts and is not updated frequently. The left window shows the results of updating a PC system clock every 30 seconds. The clock was reasonably accurate (97% of the time the client clock was not adjusted). The outlier at the high end is a conflict with the Windows Time Service (WTS). Every 6 hours, the WTS would correct the clock to an inaccurate time (off by ~10 ms). Then the accurate clock would correct it 30 seconds later. (See slide 31 for a larger graph of this data). The right window is a real-time test. Different time servers around the country showed different latencies, as would be expected. However, the experiment was done on a Sunday afternoon, so many of these latencies were mitigated. Still, there were a few ms offsets to a server as close as San Jose from Santa Rosa (100 miles). If you sync to an outlier and then drift, you can get inaccurate time.

19 Accuracy Customers Require Source: Customer Survey March 2004 Source: MSR/Distr. Survey March 2004 Notes: When customers were surveyed, most (88%) felt that it was OK if they were synchronized within a millisecond of the correct time. These are customers who own time servers. If you ask Symmetricom personnel, we thought as a group that customers had to have at least a millisecond accuracy. We may be overestimating many customers real needs.

20 Protocols Notes: UDP is a connectionless, fire and forget protocol. Time protocols are all UDP. If you are transferring a file or seeing a web page, it s TCP. TCP assures that the data gets through.

21 UDP/IP vs TCP/IP Transport IP: Internet Protocol Best effort protocol TCP: Transmission Control Protocol Connection oriented connect - send - check - send/resend check disconnect Best for moving data or control: web pages, , telnet, etc. UDP: User Datagram Protocol Connectionless Send only fire & forget * Time is generally transferred using UDP * Better to retry (using UDP) at a later time than to subject time packets to the TCP error checking/resending latencies Time clients will retry if no packet received back from time server (seconds to minutes before retry) Notes: Both TCP and UDP are using Internet Protocol (which we remember is best effort, where packets can be thrown away by routers). TCP is connection-oriented where the packet transfer is verified via the protocol. That s important if you are sending an or an important file. With a time packet, you want to minimize latency; and it doesn t really matter if the packet gets dropped. The longer the packed is held, the less valuable it is. Time marches on. If the client doesn t get a response, it tries again with another packet at a later time.

22 Typical Time Distribution Strategies

23 General Time Distribution Notes: A basic time distribution system. Here we have two Stratum 0 sources (GPS, ACTS dial-up) that connect to Stratum 1 servers (the time servers that Symmetricom sells), by radio, satellite or modem. Anything below can be a client or another time server. This system is reasonably robust. Each client has dual connections to a server in the next Stratum. If one connection or device fails (perhaps the first Stratum 0 Primary reference loses its GPS antenna), a second source of equal validity is brought on-line. Any element can be removed, and the accuracy of the time network is preserved.

24 Peering Notes: This system is functional, but slightly less robust This configuration uses NTP peering where time servers in the same Stratum measure each others time. The Stratum 0 reference here has no redundancy, but its connection does. If the left Stratum 1 server has it s connection severed (perhaps the cable is disconnected), it gets time from a secondary connection to another Stratum 1 server in the system. Because it is not connecting directly to the Primary reference, the Stratum 1 server is now considered to be Stratum 2. In turn, it s clients become relegated to Stratum 3. Peering is better than no redundancy, and is better than falling back to an unknown source outside the network.

25 A Basic NTP Network Notes: This network is not robust. There s a single primary connection to a single Network Time Server. If the connection to the server fails, or GPS is disconnected, then all clocks on the network will start drifting.

26 A Robust NTP Network Notes: This network is far more robust. Redundant Stratum 1 time servers are connecting to independent GPS Stratum 0 sources. The Stratum 1 servers are also peered. Any component can be removed without compromising time accuracy.

27 A Less Secure NTP Network Notes: If you do not want redundant time servers, the Stratum 1 server and Stratum 2 clients can use an Internet Time Server as a secondary source. The disadvantage is that customers have to open up Port 123 in their firewalls, which many IT folks are loath to do ( a closed port is a good port ). It also subjects you to a time source that may well be inaccurate and unreliable.

28 Configuring for Redundancy Notes: It s easy to configure for redundancy. SymmTime and Domain Time II both allow multiple secondary and Internet time servers to be configured. With the S100, it s a simple web-based utility. Please refer to slides for screen shots of this feature.

29 Summary Time servers are great for LANs but time transfer accuracy degrades over WANs (i.e. the Internet) The achievable 1-10 millisecond time transfer accuracy meets most customer needs Good time client software is essential for synchronization success Redundant time servers and/or peering assure a robust time distribution network

30 Intro to Networking & NTP Thanks for your time questions?

31 Pentium PC Clock Drift

32 SymmTime Server Config Notes: This shows the panels in SymmTime where additional time servers are configured as fallback sources of time.

33 Domain Time II Full Client Notes: This panel shows where up to four time servers can be configured in Domain Time II. In addition there are versatile behaviors that can be selected to optimize time accuracy.

34 S100 Servers & Peers Server A persistent client mode association with the specified remote server. In this mode the local clock can be synchronized to the remote server, but the remote server can never be synchronized to the local clock. Peer A persistent symmetric-active mode association with the specified remote peer. In this mode the local clock can be synchronized to the remote peer or the remote peer can be synchronized to the local clock. This is useful in a network of servers where, depending on various failure scenarios, either the local or remote peer may be the better source of time. Notes: In the S100 network time server you can configure Servers to get the time from and operate as Stratum II (or less) server. You can also establish peer relationships with other servers. This is useful if the GPS connection is lost and time can be obtained from other time servers.