0

One of my servers is unable to synchronize time with my internal ntp server.

It works for every servers in the DMZ except one !

Here the ntpdate debug of a server that able to synchronize :

host-10.254.250.52:~# ntpdate -u -d internal-ntp
21 Jun 11:23:13 ntpdate[22168]: ntpdate 4.2.4p4@1.1520-o Sun Nov 22 16:14:35 UTC 2009 (1)
transmit(internal-ntp)
receive(internal-ntp)
transmit(internal-ntp)
receive(internal-ntp)
transmit(internal-ntp)
receive(internal-ntp)
transmit(internal-ntp)
receive(internal-ntp)
transmit(internal-ntp)
server internal-ntp, port 123
stratum 3, precision -20, leap 00, trust 000
refid [internal-ntp], delay 0.02632, dispersion 0.00000
transmitted 4, in filter 4
reference time:    dcf49c8e.67939494  Wed, Jun 21 2017 11:19:42.404
originate timestamp: dcf49d61.40ad9621  Wed, Jun 21 2017 11:23:13.252
transmit timestamp:  dcf49d61.41bf487f  Wed, Jun 21 2017 11:23:13.256
filter delay:  0.02632  0.02650  0.02675  0.02650
         0.00000  0.00000  0.00000  0.00000
filter offset: -0.00467 -0.00469 -0.00459 -0.00464
         0.000000 0.000000 0.000000 0.000000
delay 0.02632, dispersion 0.00000
offset -0.004672

21 Jun 11:23:13 ntpdate[22168]: adjust time server internal-ntp offset -0.004672 sec

Here the tcpdump trace of a server that able to synchronize on ntp server side :

internal-ntp:/var/log# tcpdump host 10.254.250.52
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:19:20.105722 IP 10.254.250.52.34851 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:20.105764 IP internal-ntp.ntp > 10.254.250.52.34851: NTPv4, Server, length 48
11:19:20.106471 IP 10.254.250.52.34851 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:20.106499 IP internal-ntp.ntp > 10.254.250.52.34851: NTPv4, Server, length 48
11:19:20.107120 IP 10.254.250.52.34851 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:20.107163 IP internal-ntp.ntp > 10.254.250.52.34851: NTPv4, Server, length 48
11:19:20.107969 IP 10.254.250.52.34851 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:20.108000 IP internal-ntp.ntp > 10.254.250.52.34851: NTPv4, Server, length 48

Here the ntpdate debug of the server that not able to synchronize :

host-10.254.250.51:~# ntpdate -u -d internal-ntp
21 Jun 11:21:42 ntpdate[6194]: ntpdate 4.2.4p4@1.1520-o Sun Nov 22 16:14:35 UTC 2009 (1)
transmit(internal-ntp)
transmit(internal-ntp)
transmit(internal-ntp)
transmit(internal-ntp)
transmit(internal-ntp)
internal-ntp: Server dropped: no data
server internal-ntp, port 123
stratum 0, precision 0, leap 00, trust 000
refid [internal-ntp], delay 0.00000, dispersion 64.00000
transmitted 4, in filter 4
reference time:    00000000.00000000  Thu, Feb  7 2036 10:28:16.000
originate timestamp: 00000000.00000000  Thu, Feb  7 2036 10:28:16.000
transmit timestamp:  dcf49d09.f28900c5  Wed, Jun 21 2017 11:21:45.947
filter delay:  0.00000  0.00000  0.00000  0.00000
         0.00000  0.00000  0.00000  0.00000
filter offset: 0.000000 0.000000 0.000000 0.000000
         0.000000 0.000000 0.000000 0.000000
delay 0.00000, dispersion 64.00000
offset 0.000000

21 Jun 11:21:46 ntpdate[6194]: no server suitable for synchronization found

Here the tcpdump trace of the server that not able to synchronize on ntp server side :

internal-ntp:/var/log# tcpdump host 10.254.250.51
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
11:19:40.896719 IP 10.254.250.51.59008 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:40.896763 IP internal-ntp.ntp > 10.254.250.51.59008: NTPv4, Server, length 48
11:19:41.896762 IP 10.254.250.51.59008 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:41.896804 IP internal-ntp.ntp > 10.254.250.51.59008: NTPv4, Server, length 48
11:19:42.896556 IP 10.254.250.51.59008 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:42.896597 IP internal-ntp.ntp > 10.254.250.51.59008: NTPv4, Server, length 48
11:19:43.896851 IP 10.254.250.51.59008 > internal-ntp.ntp: NTPv4, Client, length 48
11:19:43.896891 IP internal-ntp.ntp > 10.254.250.51.59008: NTPv4, Server, length 48

NTP client are on Debian 5.0.10 and NTP server is on Debian 5.0.8

NTP clients config :

driftfile /var/lib/ntp/ntp.drift

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

server internal-ntp iburst dynamic

restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery

restrict 127.0.0.1
restrict ::1

NTP server config on internal-ntp : 

driftfile /var/lib/ntp/ntp.drift

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

server 0.debian.pool.ntp.org iburst dynamic
server 1.debian.pool.ntp.org iburst dynamic
server 2.debian.pool.ntp.org iburst dynamic
server 3.debian.pool.ntp.org iburst dynamic

restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery

restrict 127.0.0.1
restrict ::1
restrict 10.0.0.0 mask 255.0.0.0 nomodify notrap
benoit974
  • 21
  • 2
  • 6
  • Have you tried looking at traffic at the client side? Since the number/type of packets leaving the NTP server seem to be the same for working/non-working clients it would be useful to see if there's a difference in what arrives at the client. – Paul Haldane Jun 21 '17 at 09:26

1 Answers1

0

The none working NTP client does not recieve the packet from server, it looks like an asymmetric routing between client and server.

This NTP date on working client...

host-10.254.250.52:~# ntpdate -u internal-ntp
21 Jun 14:49:31 ntpdate[7747]: adjust time server internal-ntp offset 0.001020 sec

...Give this tcpdump trace on client side :

host-10.254.250.52:~# tcpdump port 123 and host internal-ntp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:33:43.620356 IP 10.254.250.52.35247 > internal-ntp.ntp: NTPv4, Client, length 48
15:33:43.621062 IP internal-ntp.ntp > 10.254.250.52.35247: NTPv4, Server, length 48
15:33:43.621086 IP 10.254.250.52.35247 > internal-ntp.ntp: NTPv4, Client, length 48
15:33:43.621549 IP internal-ntp.ntp > 10.254.250.52.35247: NTPv4, Server, length 48
15:33:43.621563 IP 10.254.250.52.35247 > internal-ntp.ntp: NTPv4, Client, length 48
15:33:43.622282 IP internal-ntp.ntp > 10.254.250.52.35247: NTPv4, Server, length 48
15:33:43.622294 IP 10.254.250.52.35247 > internal-ntp.ntp: NTPv4, Client, length 48
15:33:43.623012 IP internal-ntp.ntp > 10.254.250.52.35247: NTPv4, Server, length 48

This NTP date on non working client...

host-10.254.250.51:~# ntpdate -u internal-ntp
21 Jun 14:51:24 ntpdate[11773]: no server suitable for synchronization found

...Give this tcpdump trace on client side :

host-10.254.250.51:~# tcpdump dst port 123 and host internal-ntp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
14:51:20.334130 IP 10.254.250.51.43811 > internal-ntp.ntp: NTPv4, Client, length 48
14:51:21.334171 IP 10.254.250.51.43811 > internal-ntp.ntp: NTPv4, Client, length 48
14:51:22.334118 IP 10.254.250.51.43811 > internal-ntp.ntp: NTPv4, Client, length 48
14:51:23.334119 IP 10.254.250.51.43811 > internal-ntp.ntp: NTPv4, Client, length 48
benoit974
  • 21
  • 2
  • 6