LinuxQuestions.org - ntpdate's behavior when DNS returns multiple values

- Ubuntu (https://www.linuxquestions.org/questions/ubuntu-63/)

- - ntpdate's behavior when DNS returns multiple values (https://www.linuxquestions.org/questions/ubuntu-63/ntpdates-behavior-when-dns-returns-multiple-values-524571/)

ntpdate's behavior when DNS returns multiple values

Hi All,

I have recently purchased a computer with edgy eft preinstalled. The behavior of ntpdate on it is different from what I am used to and I was wondering if anybody can explain. For example, suppose I enter:

Code:

ntpdate -q 0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org

Each of the above URLs will typically return multiple IP addresses. I am used to ntpdate picking one IP address from each URL to query and then make its decision. In edgy eft, ntpdate appears to query all of the IP addresses returned for each URL.

Has ntpdate's behavior been changed recently, has Ubuntu modified it, or what? I can't find any option listed in the man page to revert to the old behavior. Can somebody tell me what's going on?

Thanks for any replies.

I'm not sure if I can actually answer your question, but when I use ntpdate (usually in VMs these days) I just use 'ntpdate pool.ntp.org' and it just works.

The 'pool' server it responsible for picking a random ntp host to sync with.

Oh, it "works" all right. After polling 12 NTP servers!!! (Using your command.) That is not the behavior I expect or what I have seen before. And while polling 3 servers seems perfectly reasonable to me, polling ten or more seems abusive of the good people who are kind enough to run the servers in the pool. I am just trying to get to the bottom of this. Maybe I need to file a bug report somewhere.

Thanks for your response. I'll flesh out my test below.

Giving the command on the Ubuntu system:

Code:

root@ubuntu:~# ntpdate pool.ntp.org

 3 Feb 02:58:33 ntpdate[23993]: adjust time server 216.193.219.108 offset -0.002643 sec

Monitoring with tcpdump on the gateway computer (The long listing is greatly truncate here -- analysis of the complete file below):

Code:

[root@Acer root]# tcpdump -nni eth1 udp port 123

tcpdump: listening on eth1

02:58:33.262303 192.168.xx.xx.123 > 207.61.229.70.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.437388 207.61.229.70.123 > 192.168.xx.xx.123:  v4 server strat 3 poll 4 prec -16 (DF) [tos 0x10]

02:58:33.437769 192.168.xx.xx.123 > 207.61.229.70.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.462280 192.168.xx.xx.123 > 212.68.213.6.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.597588 207.61.229.70.123 > 192.168.xx.xx.123:  v4 server strat 3 poll 4 prec -16 (DF) [tos 0x10]

02:58:33.598024 192.168.xx.xx.123 > 207.61.229.70.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.662270 192.168.xx.xx.123 > 216.193.219.108.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.697374 212.68.213.6.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec 0

02:58:33.697751 192.168.xx.xx.123 > 212.68.213.6.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.757388 207.61.229.70.123 > 192.168.xx.xx.123:  v4 server strat 3 poll 4 prec -16 (DF) [tos 0x10]

02:58:33.757758 192.168.xx.xx.123 > 207.61.229.70.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.827395 216.193.219.108.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec -18

02:58:33.827770 192.168.xx.xx.123 > 216.193.219.108.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.862257 192.168.xx.xx.123 > 218.185.224.5.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.917417 207.61.229.70.123 > 192.168.xx.xx.123:  v4 server strat 3 poll 4 prec -16 (DF) [tos 0x10]

02:58:33.927473 212.68.213.6.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec 0

02:58:33.927774 192.168.xx.xx.123 > 212.68.213.6.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:33.977398 216.193.219.108.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec -18

02:58:33.977777 192.168.xx.xx.123 > 216.193.219.108.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:34.062263 192.168.xx.xx.123 > 130.60.7.42.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:34.127487 216.193.219.108.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec -18

02:58:34.127814 192.168.xx.xx.123 > 216.193.219.108.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:34.157410 212.68.213.6.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec 0

02:58:34.157766 192.168.xx.xx.123 > 212.68.213.6.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:34.177776 218.185.224.5.123 > 192.168.xx.xx.123:  v4 server strat 2 poll 4 prec -19 [tos 0x10]

02:58:34.178081 192.168.xx.xx.123 > 218.185.224.5.123:  v4 client strat 0 poll 4 prec -6 (DF)

02:58:34.262236 192.168.xx.xx.123 > 149.156.24.40.123:  v4 client strat 0 poll 4 prec -6 (DF)

Analyze complete output for the IP addresses which responded:

Code:

<03:15:53(jim)jim>$cat /tmp/ntpdate_dump | sed -n "s/^.* \([[:digit:].]*\).123 > 192.*$/\1/p" | sort | uniq -c

      4 130.60.7.42

      4 149.156.24.40

      4 207.61.229.70

      4 212.68.213.6

      4 216.193.219.108

      4 218.185.224.5

      4 80.121.153.134

      4 81.2.209.38

      4 82.103.128.84

      4 82.230.52.122

      4 84.54.128.8

      4 85.214.23.162

I agree that seems to be odd behaviour and not something I've seen before. Anything interesting in your /etc/ntpd.conf (or ntpdate.conf or whatever it's called)?

Quote:

Originally Posted by jonwatson

I agree that seems to be odd behaviour and not something I've seen before. Anything interesting in your /etc/ntpd.conf (or ntpdate.conf or whatever it's called)?

The only files I have found that sound remotely relevant in /etc are /etc/ntp.conf and /etc/default/ntpdate. The first I believe pertains just to ntpd, and in any case looks normal to me. The second is used by a script that runs when network connections are brought up, but for the sake of thoroughness, here are its contents:

Code:

user@ubuntu:~$ cat /etc/default/ntpdate

# servers to check.  (Separate multiple servers with spaces.)

NTPSERVERS="0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org"

#

# additional options for ntpdate

#NTPOPTIONS="-v"

NTPOPTIONS="-u"

NTPSERVERS="ntp.ubuntu.com"



unset NTPSERVERS

The last line is a line I added to suppress the script automatically running ntpdate. The rest is the file that shipped with the distro. In any event, the anomalous behavior occurred even before I added the last line.

Should there be two NTPSERVERS lines? That doesn't seem right, although I'm not sure if that would cause the behaviour your seeing.

Quote:

Originally Posted by jonwatson

Should there be two NTPSERVERS lines? That doesn't seem right, although I'm not sure if that would cause the behaviour your seeing.

My interpretation is that when the Ubuntu people modified the Debian file, (for whatever reason) they left the old Debian line there and superseded it with their own. Just like I left both of those lines in and unset the variable. My analysis is that that file just affects a script in /etc/network/if-up.d and doesn't affect ntpdate itself. But them I am still exploring Ubuntu with lots yet to learn. :)

I was hoping somebody on the Ubuntu project might respond on this thread, as this is a real head scratcher. I though each of the forums for specific distros had some people from the respective projects monitoring them.

Anyway, thanks for your replies. I'll be happy to answer any other questions or try any experiment you might think up.