What's going on with NTP?

[javier at kjsl.org (Javier Henderson)]

On Dec 25, 2013, at 11:35 AM, John Levine <johnl at iecc.com> wrote:

> I have two FreeBSD servers where the NTP daemons are using double digit CPU
> percentages today rather than the usual 0.01%.  Restarting them didn't help.
> 
> The clock on my Android phone is five hours slow.  (It's not the time zone,
> I checked that.)
> 
> Is this just my special Christmas present, or are there screwed up NTP servers?

I suspect your servers are being attacked. Are you seeing a lot of in/out NTP traffic on those FreeBSD servers?

-jav