Lion Cipher Lab

Order events across machines with Lamport and vector clocks, when wall clocks lie

• Foundations
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Every incident timeline you will ever build is stitched together from logs written by different machines, and every one of those machines keeps its own clock. The clocks disagree. Some run fast, some slow, and NTP sometimes jumps one backwards to fix it. When you sort the logs by timestamp, effects can appear before their causes. A login can look like it happened after the data it unlocked was stolen, and an analyst can then tell the wrong story to the people who make decisions. Distributed systems engineers hit this problem decades ago and solved part of it without fixing the clocks at all.…

What you'll learn

• building a seeded simulator of four services with skewed, drifting wall clocks and an NTP step, plus a ground-truth happens-before graph computed with bitsets and no clock at all
• measuring how wall-clock skew reverses cause and effect: 0 reversed causal pairs at 0 ms skew, 346 at 100 ms, 20,831 (12.23%) at 1 s, 41,680 (24.47%) at 2 s
• implementing Lamport clocks from the 1978 rules and proving the clock condition on real data (0 violations over 170,299 causal pairs)
• showing what Lamport clocks cannot do: they put 30,830 of 31,631 concurrent pairs (97.5%) into an order that means nothing
• implementing vector clocks and checking them against ground truth: 0 disagreements over 201,930 pairs, including the concurrent ones
• fixing an incident timeline where the data access is stamped 865 ms before the attacker's login, using causal metadata instead of wall time
• implementing a hybrid logical clock (Kulkarni et al., 2014) that survives an NTP step backwards with 0 causal violations and stays within one max-skew of wall time
• measuring the limits: vector clocks cost 4 bytes per process per event (1,024 bytes at N=256), miss causality through channels you did not instrument (3.12% of ordered pairs), and trust whatever timestamp a sender forges

Steps in this lab

1. What you are building, and why sorting logs by time can lie
2. Set up: a terminal, Python, and a lab folder
3. Write the simulator: wall clocks, three logical clocks, and a referee
4. Write the experiments harness
5. Measure BEFORE: how wall clocks reverse cause and effect as skew grows
6. The incident: an attacker's login that 'happens after' the data theft
7. Measure AFTER: grade Lamport and vector clocks against ground truth
8. Hybrid logical clocks: causality that still looks like a time
9. Honest negative 1: vector clocks grow with every process you add
10. Honest negatives 2 and 3: causality you did not carry, and timestamps you should not trust
11. Do it better: what to log, and how to tell the timeline story

Open the full interactive lab →