Estimated active ntp pool clients: 551 Estimated abusive ntp pool clients: 5 Estimated inactive ntp pool clients: 86 Total ntp pool clients being tracked: 637 Note: NTP is a stateless and connectionless (UDP based) protocol, so exact numbers can't be determined. 2577171 ntp requests, in total, have been seen since 09/23/08 11:22:26 1147441 (44.5%) are from clients that are still active. Long term request rate: 0.481 seconds between requests (2.08 req/sec) Long term bandwidth in: 0.154 KBytes/s 1.233 Kbits/s Long term bandwidth in: 0.381 GB/month 3.049 Gb/month Current request rate: 0.514 seconds between requests (1.94 req/sec) Current bandwidth in: 0.144 KBytes/s 1.155 Kbits/s Current bandwidth in: 0.357 GB/month 2.854 Gb/month (NTP packets are usually 76 bytes, UDP overhead included, in each direction.) The dump file was written 35 seconds ago, at 10/07/08 20:01:25 Subnets with many clients: # of Subnet Total Aggregate Abusive IPs Count Rate Clients 33 208.195.225.x 25061 20.773 0 18 74.203.65.x 16513 53.030 0 8 76.198.119.x 4714 85.240 0 7 170.211.199.x 14742 40.225 0 5 71.80.142.x 10889 59.266 0 5 65.221.65.x 3298 181.185 0 5 213.48.19.x 41263 12.818 0 4 80.94.118.x 8921 39.517 0 4 63.118.118.x 2581 248.458 0 Clients with rapid updates (min requests of 100): Rank First Seen Client IP Requests Rate Usage Cumulative 1 09/23/08 11:22:26 24.123.66.139 206475 11.61 17.99% 17.99% * ! 2 10/01/08 16:57:04 202.83.193.105 182574 1.98 15.91% 33.91% * ! 3 10/01/08 16:52:44 80.81.226.226 41412 13.22 3.61% 37.51% * ! 4 10/01/08 16:53:02 90.183.5.1 35214 13.88 3.07% 40.58% * ! 5 10/01/08 16:53:05 213.48.51.167 24788 21.24 2.16% 42.74% * ! 6 10/01/08 16:54:22 72.250.201.7 15495 32.84 1.35% 44.09% * 7 10/01/08 16:52:56 170.211.199.22 10485 52.62 0.91% 45.01% * 8 10/01/08 16:52:46 80.94.118.2 4427 57.80 0.39% 45.39% * 9 10/01/08 16:52:58 200.40.215.102 4264 29.21 0.37% 45.77% * * = "active" = probably will send another request. ! = "abusive" = min requests of 100 and an average rate of less than 30s between requests over the life of the entire connection. Percentages are based on all packets from *active* clients. If the client is not active, its percentage is what it would be if it were active. Clients with very long updates (min requests of 10): Rank First Seen Client IP Requests Rate Usage Cumulative 1 10/01/08 16:58:57 76.229.89.6 37 14400.05 0.00% 0.00% * 2 10/05/08 12:57:49 77.49.89.158 40 5013.10 0.00% 0.01% * 3 10/01/08 17:00:01 83.18.56.94 140 3818.08 0.01% 0.02% * 4 10/01/08 16:56:01 217.205.184.235 142 3751.51 0.01% 0.03% * 5 10/02/08 17:57:45 70.162.217.246 123 3651.22 0.01% 0.04% * 6 10/05/08 00:37:03 68.33.99.193 67 3623.83 0.01% 0.05% * 7 10/05/08 10:20:19 65.1.190.102 57 3620.11 0.00% 0.05% * 8 10/01/08 17:17:31 76.232.10.77 145 3601.80 0.01% 0.07% * 9 10/02/08 13:08:49 75.175.44.81 127 3601.37 0.01% 0.08% * 10 10/04/08 16:28:16 67.101.150.84 76 3601.30 0.01% 0.08% * Clients distribution by count: bin ( bin range ) count 1 ( 1 - 1) 45 *********** 2 ( 2 - 2) 6 * 3 ( 3 - 3) 2 4 ( 4 - 4) 8 ** 5 ( 5 - 6) 3 8 ( 7 - 9) 4 * 11 ( 10 - 13) 5 * 16 ( 14 - 19) 8 ** 22 ( 20 - 26) 1 32 ( 27 - 38) 8 ** 45 ( 39 - 53) 6 * 64 ( 54 - 76) 7 * 90 ( 77 - 107) 6 * 128 ( 108 - 152) 18 **** 181 ( 153 - 215) 4 * 256 ( 216 - 304) 14 *** 362 ( 305 - 430) 20 ***** 512 ( 431 - 608) 180 ********************************************* 724 ( 609 - 861) 105 ************************** 1024 ( 862 - 1217) 53 ************* 1448 ( 1218 - 1722) 33 ******** 2048 ( 1723 - 2435) 37 ********* 2896 ( 2436 - 3444) 24 ****** 4096 ( 3445 - 4870) 15 *** 5792 ( 4871 - 6888) 4 * 8192 ( 6889 - 9741) 12 *** 11585 ( 9742 - 13777) 3 16384 ( 13778 - 19483) 1 23170 ( 19484 - 27554) 1 32768 ( 27555 - 38967) 1 46340 ( 38968 - 55108) 1 65536 ( 55109 - 77935) 0 92681 ( 77936 - 110217) 0 131072 ( 110218 - 155871) 0 185363 ( 155872 - 220435) 2 Clients distribution by rate (min requests of 10): bin ( bin range ) count 1.0 ( 0.0 - 1.2) 0 1.4 ( 1.2 - 1.7) 0 2.0 ( 1.7 - 2.4) 1 2.8 ( 2.4 - 3.4) 0 4.0 ( 3.4 - 4.8) 0 5.7 ( 4.8 - 6.7) 0 8.0 ( 6.7 - 9.5) 0 11.3 ( 9.5 - 13.5) 2 16.0 ( 13.5 - 19.0) 3 22.6 ( 19.0 - 26.9) 1 32.0 ( 26.9 - 38.1) 2 45.3 ( 38.1 - 53.8) 2 64.0 ( 53.8 - 76.1) 26 *** 90.5 ( 76.1 - 107.6) 6 128.0 ( 107.6 - 152.2) 12 * 181.0 ( 152.2 - 215.3) 13 * 256.0 ( 215.3 - 304.4) 27 *** 362.0 ( 304.4 - 430.5) 44 ****** 512.0 ( 430.5 - 608.9) 31 **** 724.1 ( 608.9 - 861.1) 30 **** 1024.0 ( 861.1 - 1217.7) 321 ********************************************* 1448.2 ( 1217.7 - 1722.2) 12 * 2048.0 ( 1722.2 - 2435.5) 9 * 2896.3 ( 2435.5 - 3444.3) 4 4096.0 ( 3444.3 - 4871.0) 21 ** 5792.6 ( 4871.0 - 6888.6) 1 8192.0 ( 6888.6 - 9742.0) 0 11585.2 ( 9742.0 - 13777.2) 0 16384.0 (13777.2 - 19484.0) 1 Clients distribution by amount of time client was active (in hours): bin ( bin range ) count 1.0 ( 0.0 - 1.2) 76 ****** 1.4 ( 1.2 - 1.7) 0 2.0 ( 1.7 - 2.4) 2 2.8 ( 2.4 - 3.4) 2 4.0 ( 3.4 - 4.8) 0 5.7 ( 4.8 - 6.7) 6 8.0 ( 6.7 - 9.5) 5 11.3 ( 9.5 - 13.5) 8 16.0 ( 13.5 - 19.0) 4 22.6 ( 19.0 - 26.9) 4 32.0 ( 26.9 - 38.1) 6 45.3 ( 38.1 - 53.8) 9 64.0 ( 53.8 - 76.1) 10 90.5 ( 76.1 - 107.6) 7 128.0 ( 107.6 - 152.2) 496 ********************************************* 181.0 ( 152.2 - 215.3) 0 256.0 ( 215.3 - 304.4) 0 362.0 ( 304.4 - 430.5) 2 Clients distribution by time since first request (in hours): bin ( bin range ) count 1.0 ( 0.0 - 1.2) 22 * 1.4 ( 1.2 - 1.7) 3 2.0 ( 1.7 - 2.4) 12 * 2.8 ( 2.4 - 3.4) 37 *** 4.0 ( 3.4 - 4.8) 5 5.7 ( 4.8 - 6.7) 3 8.0 ( 6.7 - 9.5) 6 11.3 ( 9.5 - 13.5) 9 16.0 ( 13.5 - 19.0) 6 22.6 ( 19.0 - 26.9) 4 32.0 ( 26.9 - 38.1) 6 45.3 ( 38.1 - 53.8) 9 64.0 ( 53.8 - 76.1) 10 90.5 ( 76.1 - 107.6) 7 128.0 ( 107.6 - 152.2) 496 ********************************************* 181.0 ( 152.2 - 215.3) 0 256.0 ( 215.3 - 304.4) 0 362.0 ( 304.4 - 430.5) 2 Active clients distribution by time since last request (in secs): bin ( bin range ) count 1.0 ( 0.0 - 1.2) 2 1.4 ( 1.2 - 1.7) 1 2.0 ( 1.7 - 2.4) 0 2.8 ( 2.4 - 3.4) 3 * 4.0 ( 3.4 - 4.8) 3 * 5.7 ( 4.8 - 6.7) 2 8.0 ( 6.7 - 9.5) 8 *** 11.3 ( 9.5 - 13.5) 4 * 16.0 ( 13.5 - 19.0) 6 ** 22.6 ( 19.0 - 26.9) 5 ** 32.0 ( 26.9 - 38.1) 11 ***** 45.3 ( 38.1 - 53.8) 19 ******** 64.0 ( 53.8 - 76.1) 31 ************** 90.5 ( 76.1 - 107.6) 30 ************* 128.0 ( 107.6 - 152.2) 18 ******** 181.0 ( 152.2 - 215.3) 49 ********************** 256.0 ( 215.3 - 304.4) 42 ******************* 362.0 ( 304.4 - 430.5) 56 ************************* 512.0 ( 430.5 - 608.9) 68 ******************************* 724.1 ( 608.9 - 861.1) 97 ********************************************* 1024.0 ( 861.1 - 1217.7) 66 ****************************** 1448.2 ( 1217.7 - 1722.2) 8 *** 2048.0 ( 1722.2 - 2435.5) 8 *** 2896.3 ( 2435.5 - 3444.3) 8 *** 4096.0 ( 3444.3 - 4871.0) 4 * 5792.6 ( 4871.0 - 6888.6) 1 8192.0 ( 6888.6 - 9742.0) 0 11585.2 ( 9742.0 - 13777.2) 1 Inactive clients distribution by time since last request (in secs): bin ( bin range ) count 1.0 ( 0.0 - 1.2) 0 1.4 ( 1.2 - 1.7) 0 2.0 ( 1.7 - 2.4) 0 2.8 ( 2.4 - 3.4) 0 4.0 ( 3.4 - 4.8) 0 5.7 ( 4.8 - 6.7) 0 8.0 ( 6.7 - 9.5) 0 11.3 ( 9.5 - 13.5) 0 16.0 ( 13.5 - 19.0) 0 22.6 ( 19.0 - 26.9) 0 32.0 ( 26.9 - 38.1) 0 45.3 ( 38.1 - 53.8) 0 64.0 ( 53.8 - 76.1) 0 90.5 ( 76.1 - 107.6) 0 128.0 ( 107.6 - 152.2) 0 181.0 ( 152.2 - 215.3) 0 256.0 ( 215.3 - 304.4) 0 362.0 ( 304.4 - 430.5) 0 512.0 ( 430.5 - 608.9) 1 * 724.1 ( 608.9 - 861.1) 0 1024.0 ( 861.1 - 1217.7) 1 * 1448.2 ( 1217.7 - 1722.2) 1 * 2048.0 ( 1722.2 - 2435.5) 1 * 2896.3 ( 2435.5 - 3444.3) 15 ********************** 4096.0 ( 3444.3 - 4871.0) 6 ********* 5792.6 ( 4871.0 - 6888.6) 11 **************** 8192.0 ( 6888.6 - 9742.0) 13 ******************* 11585.2 ( 9742.0 - 13777.2) 30 ********************************************* 16384.0 (13777.2 - 19484.0) 7 **********