<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
You should consider eliminating dependence on Internet-delivered NIST time and switch to GPS-based time servers. The GPS network has its own airborne atomic clocks that use a well-disciplined protocol to synchronize to NIST reference atomic time without transiting
the Internet.
<div><br>
</div>
<div>According to NIST’s documentation:</div>
<div><span style="font-size: 16px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: "Source Sans Pro Web", "Helvetica Neue", Helvetica, Roboto, Arial, sans-serif; -webkit-text-size-adjust: 100%;"><br>
</span></div>
<div><span style="font-size: 16px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: "Source Sans Pro Web", "Helvetica Neue", Helvetica, Roboto, Arial, sans-serif; -webkit-text-size-adjust: 100%;">“Currently, the GPS system provides time to the general
public with uncertainties measured in nanoseconds. With a well-designed receiver system the user can obtain the time to better than 100 ns in a few minutes, and to about +/- 10 ns with a 24 hour average (and a good local clock).”</span><br>
<br>
All sources of error in GPS time propagation total less than one millisecond, well within your 50ms tolerance. </div>
<div><br>
</div>
<div><a href="https://www.nist.gov/pml/time-and-frequency-division/time-services/one-way-gps-time-transfer">https://www.nist.gov/pml/time-and-frequency-division/time-services/one-way-gps-time-transfer</a></div>
<div><br>
</div>
<div>NIST maintains publicly-accessible logs of al clock differences to provide documented compliance under FINRA clock synchronization rules.</div>
<div><br>
</div>
<div><img src="cid:54276CD7-0F1E-4855-BA0B-BFE406A63AB5-L0-001"><br>
</div>
<div><br>
</div>
<div>The log has a one-hour resolution, satisfying the FINRA requirement to verify <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">synchronization </span>“throughout the day”. </div>
<div><br>
</div>
<div>IP-based GPS clocks are widely available with low-drift <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
oven-controlled crystal oscillators (OXCO), or even </span>internal cesium-based atomic clocks, for as little as a few thousand dollars. This lets you ride out time signal outages of days or even weeks. </div>
<div><br>
</div>
<div>The US DHS recommends discontinuation of unauthenticated Internet-based reference clocks, owing to their vulnerability to IP address spoofing:</div>
<div><br>
</div>
<div><a href="https://www.dhs.gov/sites/default/files/publications/GPS-PNT-Best-Practices-Time-Frequency-Sources-Fixed-Locations-508.pdf">https://www.dhs.gov/sites/default/files/publications/GPS-PNT-Best-Practices-Time-Frequency-Sources-Fixed-Locations-508.pdf</a></div>
<div><br>
</div>
<div><br>
</div>
<div>
<div dir="ltr">-mel via cell</div>
<div dir="ltr"><br>
<blockquote type="cite">On Jun 14, 2021, at 3:51 AM, Matthew Huff via Outages <outages@outages.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr"><span>We have to query and compare against NIST time servers for FINRA compliance This morning I noticed our systems are unable to DNS query the NIST time servers. Neither our local resolvers or google (8.8.8.8) work.</span><br>
<span></span><br>
<span>[root@bacall log]# dig @8.8.8.8 time-a-g.nist.gov</span><br>
<span></span><br>
<span>; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.5 <<>> @8.8.8.8 time-a-g.nist.gov</span><br>
<span>; (1 server found)</span><br>
<span>;; global options: +cmd</span><br>
<span>;; Got answer:</span><br>
<span>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36018</span><br>
<span>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1</span><br>
<span></span><br>
<span>;; OPT PSEUDOSECTION:</span><br>
<span>; EDNS: version: 0, flags:; udp: 512</span><br>
<span>;; QUESTION SECTION:</span><br>
<span>;time-a-g.nist.gov. IN A</span><br>
<span></span><br>
<span>;; Query time: 6 msec</span><br>
<span>;; SERVER: 8.8.8.8#53(8.8.8.8)</span><br>
<span>;; WHEN: Mon Jun 14 06:27:45 EDT 2021</span><br>
<span>;; MSG SIZE rcvd: 46</span><br>
<span></span><br>
<span>[root@bacall log]# dig @8.8.8.8 nist.gov in soa</span><br>
<span></span><br>
<span>; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.5 <<>> @8.8.8.8 nist.gov in soa</span><br>
<span>; (1 server found)</span><br>
<span>;; global options: +cmd</span><br>
<span>;; Got answer:</span><br>
<span>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 17779</span><br>
<span>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1</span><br>
<span></span><br>
<span>;; OPT PSEUDOSECTION:</span><br>
<span>; EDNS: version: 0, flags:; udp: 512</span><br>
<span>;; QUESTION SECTION:</span><br>
<span>;nist.gov. IN SOA</span><br>
<span></span><br>
<span>;; Query time: 5 msec</span><br>
<span>;; SERVER: 8.8.8.8#53(8.8.8.8)</span><br>
<span>;; WHEN: Mon Jun 14 06:31:59 EDT 2021</span><br>
<span>;; MSG SIZE rcvd: 37</span><br>
<span></span><br>
<span>The time servers are documented here: https://tf.nist.gov/tf-cgi/servers.cgi</span><br>
<span></span><br>
<span>Using the IP addresses work, it look like the nist.gov domain is offline.</span><br>
<span></span><br>
<span>Matthew Huff | Director of Technical Operations | OTA Management LLC</span><br>
<span></span><br>
<span>Office: 914-460-4039</span><br>
<span>mhuff@ox.com | www.ox.com</span><br>
<span>.........................................................................................................................................</span><br>
<span></span><br>
<span>_______________________________________________</span><br>
<span>Outages mailing list</span><br>
<span>Outages@outages.org</span><br>
<span>https://puck.nether.net/mailman/listinfo/outages</span><br>
<span></span><br>
</div>
</blockquote>
</div>
</body>
</html>