cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
19424
Views
40
Helpful
4
Replies

Has anyone seen this message from a WS-C2960S-48FPS-L switch: NTP Core (INFO): x.x.x.x 961D 8D popcorn popcorn

lancehino
Level 4
Level 4

Strange while viewing logfile on a WS-C2960S-48FPS-L I saw several of these messages:

NTP Core (INFO): X.X.X.X  961D 8D popcorn popcorn

Tried searching on internet or on Cisco's sight and did not find results.

What does this mean?

4 Replies 4

Wilson Bonilla
Level 3
Level 3

Hello Lancehino.

You are hitting the bug:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCug48022

Remove "NTP Core (INFO):946D 8D  popcorn popcorn" from 'ntp logging'

Symptom:
Log messages printed on the logging output:

Apr  5 06:49:54.038 MET-DST: NTP Core (INFO):  946D 8D popcorn popcorn
Apr  5 15:53:12.055 MET-DST: NTP Core (INFO):  963D 8D popcorn popcorn

Conditions:
'ntp logging' is enabled.


Workaround:
Disable NTP logging. This is cosmetic in nature.            

More information: NTP popcorn is explained here:

http://tools.ietf.org/html/draft-ietf-ntp-ntpv4-algorithms-01

Regards.

Wilson B.         

Please rate if useful!!!

Great info - Thanks
Regards, Alex. Please rate useful posts.

Kurt Bergstrom
Level 1
Level 1

seeing same issue on  CISCO2951/K9 running 15.2(4)M5

Sep 18 09:48:12.482: NTP Core (INFO): XXXXXXXXXX 941D 8D popcorn popcorn
Sep 18 10:21:54.482: NTP Core (INFO): XXXXXXXXXX 964D 8D popcorn popcorn
Sep 18 10:41:14.481: NTP Core (INFO): XXXXXXXXXX 941D 8D popcorn popcorn
Sep 18 11:34:32.480: NTP Core (INFO): XXXXXXXXXX 941D 8D popcorn popcorn

 

cjcbts
Level 1
Level 1

I found the following site which reports that a "popcorn spike" is a spike in NTP message delay variance. In other words, an NTP message that has an unusually large delay.

 

http://what-when-how.com/computer-network-time-synchronization/popcorn-and-step-control-clock-discipline-algorithm-computer-network-time-synchronization/

 


Computer networks are noisy places. Incidental network jitter varies over a wide range, and spikes are not infrequent. The clock filter algorithm greatly reduces network jitter and removes most spikes for each server separately, but spikes can also occur when switching from one server to another. Specific provisions have been incorporated in the discipline to further attenuate these disturbances in the form of spike suppressors, noise gates, and the aptly named huff-’n-puff filter. While not strictly a grooming provision, the step threshold and panic threshold are designed to protect against broken hardware or completely insane servers.

 

As a practical matter, a not uncommon hazard in global Internet timekeeping is an occasional large offset spike, called a popcorn spike, due to some transient phenomenon in the network. Popcorn spike suppressors are used in the clock filter and discipline algorithms to avoid these spikes. They operate by tracking the exponentially averaged jitter and discarding a spike that exceeds a threshold equal to some multiple of the average. The spike itself is then used to update the average, so the threshold is self-adaptive. Popcorn spike suppressors are effective for only a single spike or two and not under extreme conditions of network jitter as on some international Internet circuits.

 

...



 Additionally "The Network Time Protocol Version 4 Algorithm Specification" has a more technical definition for it at the following site:

https://tools.ietf.org/html/draft-ietf-ntp-ntpv4-algorithms-01

 

A 'popcorn spike' is a transient outlier, usually only a single
   sample, that is typical of congested Internet paths.  The popcorn

...
spike suppressor is designed to detect and remove them. Let theta_prime be the peer offset determined by the previous message and psi the current peer jitter. If |theta - theta_prime| > (K_s * psi), where K_s is a tuning parameter that defaults to 3, the sample is a popcorn spike and is discarded.

 

Review Cisco Networking for a $25 gift card