Re: NTP

From: John Smith (nospam_at_nowhere.com)
Date: 09/20/04


Date: Sun, 19 Sep 2004 22:01:29 -0700

Friedrich Remmert wrote:
> Hi John,
>
> Thanks for Your help!
> fr.
>
> remote refid st t when poll reach delay offset
> jitter
> ==============================================================================
> ntp1.ptb.de 0.0.0.0 16 u - 1024 0 0.000 0.000
> 4000.00
> ntp2.ptb.de 0.0.0.0 16 u - 1024 0 0.000 0.000
> 4000.00
> 19 Sep 12:58:48 ntpdate[11707]: ntpdate 4.1.1@1.786 Tue Apr 13 16:48:29 UTC
> 2004 (1)
> transmit(192.53.103.103)
> receive(192.53.103.103)
> transmit(192.53.103.103)
> receive(192.53.103.103)
> transmit(192.53.103.103)
> receive(192.53.103.103)
> transmit(192.53.103.103)
> receive(192.53.103.103)
> transmit(192.53.103.103)
> server 192.53.103.103, port 123
> stratum 1, precision -17, leap 00, trust 000
> refid [PTB], delay 0.09274, dispersion 0.00038
> transmitted 4, in filter 4
> reference time: c4f7e4e8.bd012000 Sun, Sep 19 2004 12:58:48.738
> originate timestamp: c4f7e4ea.08446000 Sun, Sep 19 2004 12:58:50.032
> transmit timestamp: c4f7e4e9.0aa37ac3 Sun, Sep 19 2004 12:58:49.041
> filter delay: 0.09438 0.09274 0.09352 0.09317
> 0.00000 0.00000 0.00000 0.00000
> filter offset: 0.956759 0.956191 0.956629 0.956608
> 0.000000 0.000000 0.000000 0.000000
> delay 0.09274, dispersion 0.00038
> offset 0.956191
>
> John Smith wrote:
>
>
>>Friedrich Remmert wrote:
>>
>>>The firewall door is open (service ntp set).
>>>Ping ntp1.ptb.de is running.
>>>It's a public timeserver.
>>>ntp.conf is default with added timerservers
>>>What can I do?
>>>
>>>Thanks!
>>>
>>
>>Friedrich,
>>
>>Please post the output of:
>>
>>1. ntpq -c peers
>>2. ntpdate -dvq ntp1.ptb.de
>>
>>John
>
>

Ok, let's decipher the output:

ntpq -c peers:
As siftp mentioned, the 'reach' column shows how many successful
responses have been received. It is an octal value with 0 meaning
no responses to 377 meaning 100% success. The stratum column (st)
also changes when the server has been contacted. 16 means out of
service (never reached).

ntpdate -dvq ...:
This command tests if the server is reachable and if it will
respond to your client (ntpd). From the output, we see both
transmit and response so things look good. It also means that
these packets are getting by the firewall. The command also shows
that your system's clock is quite close to the server (good).

So, my conclusion is that your setup looks good, but the fire
wall may be getting in the way (inadvertantly). Do you have UDP
port 123 open in the /etc/sysconfig/SuSEFirewall2 file? (just search
for ntp or 123).

Another quick test would be deactivate the firewall temporarily
(rcSuSEFirewall2 stop) and then restart the ntpd daemon (rcntpd restart)
(It might be rcxntpd my memory fails me at the moment). Wait about
2-3 mins (for the first few ntp packets to get exchanged). Then run
ntpq -c peers again and see if the 'reach' value is modified.

*NOTE: Be sure to reactivate your firewall after your test *
(rcSuSEFirewall2 start).

Then if you observe the reach counter dropping after the firewall
has been restarted, you know that the firewall file needs to be
adjusted.

John



Relevant Pages

  • Re: OE Send/Recieve Broken - NOT firewall/av-related
    ... AFAIK there have been no "auto-updates...pushed in the last few days", John. ... > Your server has unexpectedly terminated the connection. ... > NO FIREWALL, ... > don't point me to AV/Firewall disabling instructions. ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • RE: SBS2003 Logon and service problem
    ... One other thing that I have just learned is that we are also running an APC ... headaches with the server. ... "John" wrote: ... The same happens when we attempt to restart any ...
    (microsoft.public.windows.server.sbs)
  • Re: ISA NLB Drain/Stop
    ... some internal users lose access to websites until they restart their browser. ... Since our clients are Firewall Clients first and foremost, the firewall sessions will be tied to a particular server. ...
    (microsoft.public.isa.configuration)
  • Protecting windows firewall!
    ... We're running Windows XP Pro with SP2 and firewall enabled on the server and ... John (my ... on the server computer. ... slowing down the internet connection. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Hardware firewall
    ... "John" wrote in ... > As an update to a previous post, it seems a firewall on a separate ... > machine is better protection than one on a web server. ...
    (comp.security.firewalls)