Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've noticed that, after changing the reg settings outlined in Episode 52 of the Stack Overflow podcast to, my box keeps requesting time from The web site hosted on that box is very strange. Is this a valid timeserver?

share|improve this question
OK gordo, enough self-promotion. :) I edited the question to be a bit more general.. – Jeff Atwood Jun 13 '09 at 3:15

12 Answers 12

The is a DNS-level load balancer. Jeff just happened to get directed to that one, the NTP pool maintainers do not care what does the server run on it's port 80 (http), only that it serves time via NTP correctly.

share|improve this answer

I just listened to episode 52 of the podcast and noticed the same thing Joel did. This server lives in the pool of time servers. As noted by Alex, it's serving a valid time and doesn't seem to be doing anything out of spec.

share|improve this answer

This looks like a legitimate time server to me:

[hex]~% ntpdate -q server, stratum 2, offset 21.538520, delay 0.05049 12 Jun 13:07:19 ntpdate[1098]: step time server offset 21.538520 sec

If you're ever curious, and have ntpdate installed, you can always use the -q option to simply ask for the time without changing your clock.

It's very strange, though.

share|improve this answer

I certainly wouldn't worry about it as a time server. Everything seems fine wrt the NTP service. The web site is funny, but, as Skolima said, the pool doesn't place any restrictions on the web site content in the pool. I have to say, I got a kick out of "Gordo's response."

Have fun

share|improve this answer

Just pick a "real" time server ... the fine folks at NIST are paid to render this service.

share|improve this answer
-1 for suggesting to use Stratum 1 time servers without qualifying a need. See . – Jesper Mortensen Sep 7 '09 at 2:03
+1 for reading the documentation! – Joseph Kern Sep 18 '09 at 9:51

This is a legitimate time server. It's a stratum-2 server and is linked to 12 stratum-1 time sources.

share|improve this answer

If you look at the main domain,, it is a legit security blog.

As for the subdomain, I have no idea.


share|improve this answer
Hmm. Never trust security guys! My guess: someone decided to attack HTTPS by turning back the clocks on expired certs. There may even be a time based attack in revocation lists. – jldugger Jun 12 '09 at 19:30
Hey, I resemble that remark! :) – Josh Brower Jun 12 '09 at 20:11

There doesn't appear to be any problem with the server. Clearly, the server administrators are completely insane, but I consider that a bonus! :) I'm now a big fan of

share|improve this answer

That's an excellent point Jeff. I think is a great resource and generally assists the Internet in ways y'all noted in Episode 52.

That said, it's interesting to me that anyone, anywhere, can inject a server into the NTP pool. From an adversarial perspective, this has some potential impact. From an architectural perspective, I think the way the pool is constructed can minimize the impact.

However, should an adversary employ some type of DNS cache poisoning attack to shift a network's NTP syncs to their malicious server, it could get interesting. There are many other attack scenarios I can think of.

share|improve this answer

You should make sure that you are using the most specific geographic area that matches your location and that is offered at

For example, there is a that will always return a time server in the United States. There are other geographic pools available around the world.

This ensures that you will not receive a time server half way around the world when a perfectly good and more accurate server might be in your back yard.

This was also discussed in another thread on Server Fault

share|improve this answer

The way that works is that DNS lookups for time servers redirect to one (randomly selected) member of the pool. Each server that's in the pool will have its own name, and if you do a reverse DNS lookup on its IP address you'll get its real name, not the pool name you started with.

Perhaps an example will help:

$ nslookup
Non-authoritative answer:

$ nslookup
Non-authoritative answer:     name =

$ randy@hex:~$ nslookup
Non-authoritative answer:      name =
share|improve this answer is my new favorite song. I'm going this machine as my primary time server from now on. Too awesome.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.