[SOLVED] NTP Problem

tronayne · 05-03-2014, 12:17 PM

Just for grins, try checking the BIOS clock.

WilliamS · 05-03-2014, 01:28 PM

Everything in BIOS that refers to the word "clock" says "AUTO".
What should I look for?

BTW this is the same BIOS I've been using for years, never messed with it and no problems while npt was working perfectly Until I Installed slackware-14.1.

tronayne · 05-03-2014, 04:14 PM

Quote:

Originally Posted by WilliamS

Everything in BIOS that refers to the word "clock" says "AUTO".
What should I look for?

I dunno -- but, what time is it? Can you look at the date and time and see if it's set to accurately to UTC? Maybe click on it or something (the BIOS's on my machines display the clock time and date and you hit the right arrow key or the enter key or click to see what the date and time are).

mlslk31 · 05-03-2014, 05:21 PM

Quote:

Originally Posted by WilliamS

Never referenced time to WWV or CHU, just set it during installation of the OS and no problems.

That would take special setup and probably a recompile of ntpd. Because you live too close to CHU, I'll back off of the radio clock idea. The WWV ntpd driver is awesome, but the way it works with audio samples almost requires a separate PC with little running on it.

Quote:

I have no access to the modem control.

Not even a Web interface? Usually, there's a Web interface at http://numeric_address_of_router, though I've had a ZyXEL router that put it at http://numeric_address_of_router:8080. See the instruction manual for your modem to get the details. This may require a trip to the manufacturer's Web site--your ISP may not provide more than the modem and some papers--and it helps to have the papers that came with the original modem installation by your ISP.

Quote:

nmap scan of port 123 shows as it should be, same as before.
I found a macro for ntp in my firewall and enabled it to make sure that port is working; no difference in anything detected.

How well does ntpd work with the firewall turned off? Should you not wish to turn the firewall off for security reasons, you can still test ntpd between two PCs with no Internet connection and firewalls shut off.

Alternatively, you could somehow install chrony and see if it somehow works. At least according to the chronyd FAQ, it uses ports 123/udp and 323/udp. So if chronyd works, it's not total proof that port 123/udp is broken, but you would get your time somehow. Just don't run it at the same time as ntpd. I'm doubtful that this is the solution, just putting it there as an option.

WilliamS · 05-03-2014, 08:05 PM

Quote:

Originally Posted by tronayne

I dunno -- but, what time is it? Can you look at the date and time and see if it's set to accurately to UTC? Maybe click on it or something (the BIOS's on my machines display the clock time and date and you hit the right arrow key or the enter key or click to see what the date and time are).

We did that already, and the hardware clock and system clock show UTC and local time. Difference of a fraction of a second, which is my reaction time.

WilliamS · 05-03-2014, 10:24 PM

mlslk31, thanks for the chrony advice - I've installed it and been playing. Has better documentation for troubleshooting.
Tried the chronyc accheck command, and got:

Code:

# chronyc accheck 0.ca.pool.ntp.org
501 Not authorised

Does this tell anything useful?

But it does not work either.

My satellite modem is a black box. Only thing I can do to it is reset it by pulling the power plug, wait 2 minutes, then pwr up.
This from the install manual.

eloi · 05-04-2014, 08:03 AM

I'm curious too about what happens disabling your firewall. I've read you use shorewall. I would even try removing it and cleaning iptables rules:

Code:

# iptables -P INPUT ACCEPT
# iptables -P OUTPUT ACCEPT
# iptables -P FORWARD ACCEPT
# iptables -F
# iptables -X
# iptables -t nat -F

Besides, are you really sure you can't access your modem from your browser like mlslk31 told you? Have you tried?

tronayne · 05-04-2014, 08:47 AM

Every satellite modem/router I've had (from HughesNet) is addressed at http://192.168.0.1.

See if you can ping it with

Code:

ping -c 5 192.168.0.1

and, if you can, connect to it with the URL link above and see what's what (should give you information about it).

If you can't ping that address, try 192.168.1.1 (sometimes).

Maybe, maybe not, but it's worth a couple of seconds to find out, eh?

WilliamS · 05-04-2014, 08:49 AM

eloi, thanks for howto disable firewall. I will try that.

Come to think of it, there is a url for the modem, but it is read-only AFAIK.

WilliamS · 05-04-2014, 11:50 AM

Disabled firewall according to eloi, tried ntpq -pn, still no change.
Then tried shorewall clear command, from the man page:
Clear will remove all rules and chains installed by Shorewall. The
firewall is then wide open and unprotected. Existing connections
are untouched. Clear is often used to see if the firewall is
causing connection problems.

And that also made no difference to ntpq -pn.

Then did slackpkg reinstall ntp*
--entered the server stuff and commented out the fudge lines.

no difference to ntpq -pn.

Every time, the above command shows that ntpd is getting the server names, so it is communicating through port 123, but it looks like it gets no data from these servers, or it is not doing anything with whatever data comes in (I may not know what I'm talking about):

Code:

# ntpq -pn
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 72.51.27.50     .INIT.          16 u    -  256    0    0.000    0.000   0.000
 67.215.197.151  .INIT.          16 u    -  256    0    0.000    0.000   0.000
 198.27.65.66    .INIT.          16 u    -  256    0    0.000    0.000   0.000
 192.95.20.208   .INIT.          16 u    -  256    0    0.000    0.000   0.000

eloi · 05-04-2014, 12:32 PM

Have you restarted ntpd after removing iptables rules?

# /etc/rc.d/rc.ntpd restart

then

# ntpq -p

eloi · 05-04-2014, 01:19 PM

Quote:

Originally Posted by WilliamS

Every time, the above command shows that ntpd is getting the server names, so it is communicating through port 123, but it looks like it gets no data from these servers, or it is not doing anything with whatever data comes in (I may not know what I'm talking about):

Code:

# ntpq -pn
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 72.51.27.50     .INIT.          16 u    -  256    0    0.000    0.000   0.000
 67.215.197.151  .INIT.          16 u    -  256    0    0.000    0.000   0.000
 198.27.65.66    .INIT.          16 u    -  256    0    0.000    0.000   0.000
 192.95.20.208   .INIT.          16 u    -  256    0    0.000    0.000   0.000

Like tronayne explained you, that happens when ntpd doesn't get synchronized in the first attempt (/etc/rc.d/rc.ntpd uses the option -g). That's why after each thing you modify to try you have to *restart* the daemon.

Besides check here:

http://support.ntp.org/bin/view/Supp...bleshootingNTP

The point 9.8 says:

"When trying to debug problems using ntpdate and ntpq, note that these utilities may use unprivileged high-numbered ports, while ntpd requires full bidirectional access to the privileged UDP port 123."

WilliamS · 05-04-2014, 04:11 PM

Code:

# shorewall stop
Stopping Shorewall....
Processing /etc/shorewall/stop ...
Processing /etc/shorewall/tcclear ...
Running /usr/sbin/iptables-restore...
IPv4 Forwarding Enabled
Processing /etc/shorewall/stopped ...
done.
bash-4.2# shorewall clear
Clearing Shorewall....
Processing /etc/shorewall/stop ...
Processing /etc/shorewall/tcclear ...
Running /usr/sbin/iptables-restore...
IPv4 Forwarding Enabled
Processing /etc/shorewall/stopped ...
Processing /etc/shorewall/clear ...
done.
bash-4.2# /etc/rc.d/rc.ntpd restart
Stopping NTP daemon...
Starting NTP daemon:  /usr/sbin/ntpd -g
bash-4.2# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 time.0x90.ca    .INIT.          16 u    -   64    0    0.000    0.000   0.000
 srv4.hrtech.de  .INIT.          16 u    -   64    0    0.000    0.000   0.000
 ntp1.sscgateway .INIT.          16 u    -   64    0    0.000    0.000   0.000
 ellen.linuxgene .INIT.          16 u    -   64    0    0.000    0.000   0.000
bash-4.2# shorewall restart
Compiling...
Processing /etc/shorewall/params ...

So it still remains that no matter how many tests, there is nothing wrong with ntp, shorewall, clock.
I would like to look elsewhere, but don't know where.

Xsane · 05-04-2014, 07:24 PM

Try this from a web browser on the same machine.

https://www.grc.com/x/portprobe=123

What does ntptrace show?

WilliamS · 05-04-2014, 09:22 PM

grc.com shows:
123
Stealth ntp
Network Time Protocol

Code:

# ntptrace 
localhost: stratum 16, offset 0.000000, synch distance 0.000000

and

Code:

# ntptrace 0.ca.pool.ntp.org
192.75.12.11: timed out, nothing received
***Request timed out