10-09-2013 07:00 AM - edited 03-07-2019 03:56 PM
Strange while viewing logfile on a WS-C2960S-48FPS-L I saw several of these messages:
NTP Core (INFO): X.X.X.X 961D 8D popcorn popcorn
Tried searching on internet or on Cisco's sight and did not find results.
What does this mean?
10-09-2013 10:16 AM
Hello Lancehino.
You are hitting the bug:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCug48022
Remove "NTP Core (INFO):946D 8D popcorn popcorn" from 'ntp logging' | |
Symptom: Log messages printed on the logging output:Apr 5 06:49:54.038 MET-DST: NTP Core (INFO): 946D 8D popcorn popcorn Apr 5 15:53:12.055 MET-DST: NTP Core (INFO): 963D 8D popcorn popcornConditions: 'ntp logging' is enabled. Workaround: Disable NTP logging. This is cosmetic in nature. |
More information: NTP popcorn is explained here:
http://tools.ietf.org/html/draft-ietf-ntp-ntpv4-algorithms-01
Regards.
Wilson B.
Please rate if useful!!!
06-01-2020 12:38 AM
09-18-2014 04:52 AM
seeing same issue on CISCO2951/K9 running 15.2(4)M5
Sep 18 09:48:12.482: NTP Core (INFO): XXXXXXXXXX 941D 8D popcorn popcorn
Sep 18 10:21:54.482: NTP Core (INFO): XXXXXXXXXX 964D 8D popcorn popcorn
Sep 18 10:41:14.481: NTP Core (INFO): XXXXXXXXXX 941D 8D popcorn popcorn
Sep 18 11:34:32.480: NTP Core (INFO): XXXXXXXXXX 941D 8D popcorn popcorn
11-22-2017 02:07 PM - edited 11-22-2017 02:13 PM
I found the following site which reports that a "popcorn spike" is a spike in NTP message delay variance. In other words, an NTP message that has an unusually large delay.
Computer networks are noisy places. Incidental network jitter varies over a wide range, and spikes are not infrequent. The clock filter algorithm greatly reduces network jitter and removes most spikes for each server separately, but spikes can also occur when switching from one server to another. Specific provisions have been incorporated in the discipline to further attenuate these disturbances in the form of spike suppressors, noise gates, and the aptly named huff-’n-puff filter. While not strictly a grooming provision, the step threshold and panic threshold are designed to protect against broken hardware or completely insane servers.
As a practical matter, a not uncommon hazard in global Internet timekeeping is an occasional large offset spike, called a popcorn spike, due to some transient phenomenon in the network. Popcorn spike suppressors are used in the clock filter and discipline algorithms to avoid these spikes. They operate by tracking the exponentially averaged jitter and discarding a spike that exceeds a threshold equal to some multiple of the average. The spike itself is then used to update the average, so the threshold is self-adaptive. Popcorn spike suppressors are effective for only a single spike or two and not under extreme conditions of network jitter as on some international Internet circuits.
...
Additionally "The Network Time Protocol Version 4 Algorithm Specification" has a more technical definition for it at the following site:
https://tools.ietf.org/html/draft-ietf-ntp-ntpv4-algorithms-01
A 'popcorn spike' is a transient outlier, usually only a single sample, that is typical of congested Internet paths. The popcorn
...
spike suppressor is designed to detect and remove them. Let theta_prime be the peer offset determined by the previous message and psi the current peer jitter. If |theta - theta_prime| > (K_s * psi), where K_s is a tuning parameter that defaults to 3, the sample is a popcorn spike and is discarded.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide