Firewall Wizards mailing list archives

Re: Acqusition of time


From: Frank Knobbe <fknobbe () knobbeits com>
Date: 31 Jan 2003 01:13:18 -0600

On Thu, 2003-01-30 at 03:23, Martin Peikert wrote:
Ben Nagy wrote:
If a firewall can't reach an NTP server because of some transient network
condition the clock doesn't automatically go haywire - it will just start
drifting as per the normal accuracy of the hardware clock, no?

Not necessarily. You could use clockspeed, see 
http://cr.yp.to/clockspeed.html
,-----------------------------------------------------------------------
| clockspeed uses a hardware tick counter to compensate for a
| persistently fast or slow system clock. Given a few time measurements
| from a reliable source, it computes and then eliminates the clock
| skew.
`-----------------------------------------------------------------------


Just a word of caution. I'm using clockspeed on about a dozen FreeBSD
boxes, and it does indeed do a great job. However, it only adjusts the
software clock. That means that, if the OS doesn't write the current
software time back into the hardware clock before a reboot, or if the
system crashes or looses power, you will have the wrong time at the next
boot up. 

That in turn means that you will have to fetch the current time upon
startup. Clockspeed is great in keeping the time drift to a minimum
while the system is running. But you still need to sync your time on
startup.

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part


Current thread: