[SOLVED] NTP Troubleshooting

scarpozzi · 04-07-2014, 01:48 PM

**UPDATE** This was solved. I looked at the traffic and wireshark and saw that the NTP responses were missing a lot of information. I went to the vendor site again and noticed that there was an option for a firmware update. The firmware running was released in December 2011. They JUST released a patch in January of this year. I'm guessing the recent NTP security patches broke whatever implementation they settled on back in 2011. Firmware saved me a lot of time and my systems appear to be happy again.

I'm trying to troubleshoot some NTP server devices(GPS appliance). These boxes report as being online and functional. They appear to be working, but I noticed that when I restart the ntpd client on one of my linux servers, it's not synchronizing with the time servers:

Code:

/etc/init.d/ntpd restart
Shutting down ntpd:                                        [  OK  ]
ntpd: Synchronizing with time server:                      [FAILED]
Starting ntpd:                                             [  OK  ]

I switched to my desktop and am having trouble connecting to the time servers as well. When I try to query the server in linux, I keep getting timeouts.

Code:

$ ntptrace 192.168.1.100
192.168.1.100: timed out, nothing received
***Request timed out

Code:

$ ntpdate -q 192.168.1.100
server 192.168.1.100 , stratum 16, offset -0.001145, delay 0.03400
7 Apr 14:34:29 ntpdate[29434]: no server suitable for synchronization found

I can replace those IPs with time.windows.com or 0.rhel.pool.ntp.org, etc...and I get a proper response using 'ntpdate -q'.

I can ping the ip address, firewall is open for 123 UDP in/out....and it responds in windows.

I can get a valid response via a Windows using this:

Code:

w32tm /stripchart /computer:192.168.1.100 /dataonly

Any ideas what I should try from here? I'd like to avoid breaking out wireshark if I can...

michaelk · 04-07-2014, 02:11 PM

Can you post the make/model of the time server?
Is there any way to check to see if it actually synched to GPS and has a valid time?

scarpozzi · 04-07-2014, 02:26 PM

Quote:

Originally Posted by michaelk

Can you post the make/model of the time server?
Is there any way to check to see if it actually synched to GPS and has a valid time?

http://css-timemachines.com/TM1000A-...B002RC3Q4Q.htm

It appears to....I don't have access to the administration side of the box.

Windows 7 in Virtualbox reports this:

Code:

w32tm /stripchart /computer:192.168.1.100 /dataonly
Tracking 192.168.1.100 [192.168.1.100:123]
The current time is 4/7/2014 1:22:37 PM.
13:22:37, -00.1711584s
13:22:39, -00.1782864s
13:22:41, -00.1726224s
13:22:43, -00.1749584s
13:22:45, -00.1762944s

This Windows 7 vm is running from the same linux system I ran the ntpdate and ntptrace commands from... That's what helps me rule out firewall issues. Just trying to figure this out.

Thanks.

EDIT: I think I figured it out. I went back and clicked on the link for the device. It appears those are SNTP servers. I was able to query the server from linux using SNTP:

Code:

$ sudo sntp 192.168.1.100
 7 Apr 15:52:48 sntp[29898]: Started sntp
2014-04-07 15:52:48.883572 (+0500) -0.006

Now my question is whether or not I can configure 3-5 servers as SNTP clients and NTP servers to rebroadcast as a STRATUM 2 local pool.

Thanks. I'm shifting my research now I have more of an idea of what was causing me to get no response.

unSpawn · 04-07-2014, 03:49 PM

Moved: This thread is more suitable in the Linux Software Forum and has been moved accordingly to help your thread/question get the exposure it deserves.

michaelk · 04-07-2014, 04:13 PM

I'm not familiar with this particular device. It appears that it can be both a ntp and sntp server. Nothing in the manual shows any unique configuration settings for NTP.

An Amazon review did indicate that these devices do have a limitation that they cannot handle being queried by more than a few devices at a time however the manual states 135+ is possible.

scarpozzi · 04-07-2014, 05:16 PM

I saw in the spec that it supports NTP as well. I installed wire shark earlier today...I'll throw it some traffic and see what it's doing.

It's annoying just because the way it's failing.

Thanks for looking. I appreciate a second set of eyes on it even though it ultimately will come down to packet analysis to see what is actually happening.

-Scar