Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP and stratum issue

    Scheduled Pinned Locked Moved General pfSense Questions
    20 Posts 6 Posters 7.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F Offline
      fatsailor
      last edited by

      ummm - yeah I am. The weird thing is that 'ntpdate -ud 10.1.1.1' and 'ntpq -c rv 10.1.1.1' return different results on a client box when pointed to the pfsense box.

      I know ntpdate is being depreciated but this is just a bit nuts.

      I've clients, e.g. the Freenas box, that won't accept the pfsense box as a time server because of the stratum issue. I'm wondering if this is a software version mismatch issue?

      This is all done on the pfsense box

      ntpq> host localhost
      current host set to localhost
      ntpq> rv
      associd=0 status=0615 leap_none, sync_ntp, 1 event, clock_sync,
      version="ntpd 4.2.8p4@1.3265-o Mon Oct 26 14:28:17 UTC 2015 (1)",
      processor="amd64", system="FreeBSD/10.1-RELEASE-p25", leap=00, stratum=2,
      precision=-23, rootdelay=24.781, rootdisp=585.121, refid=204.9.54.119,
      reftime=da31a54c.232af4c7  Fri, Jan  1 2016 20:24:28.137,
      clock=da31a561.e76f2bd6  Fri, Jan  1 2016 20:24:49.904, peer=58444, tc=6,
      mintc=3, offset=28.685194, frequency=18.604, sys_jitter=117.371580,
      clk_jitter=7.981, clk_wander=0.000
      ntpq> host 10.1.1.1
      current host set to 10.1.1.1
      ntpq> rv
      associd=0 status=0615 leap_none, sync_ntp, 1 event, clock_sync,
      version="ntpd 4.2.8p4@1.3265-o Mon Oct 26 14:28:17 UTC 2015 (1)",
      processor="amd64", system="FreeBSD/10.1-RELEASE-p25", leap=00, stratum=2,
      precision=-23, rootdelay=24.781, rootdisp=585.436, refid=204.9.54.119,
      reftime=da31a54c.232af4c7  Fri, Jan  1 2016 20:24:28.137,
      clock=da31a576.73554a5e  Fri, Jan  1 2016 20:25:10.450, peer=58444, tc=6,
      mintc=3, offset=28.685194, frequency=18.604, sys_jitter=117.371580,
      clk_jitter=7.981, clk_wander=0.000
      ntpq>

      This is done on a Freenas box

      ntpq> host 10.1.1.1
      current host set to 10.1.1.1
      ntpq> rv
      assID=0 status=0615 leap_none, sync_ntp, 1 event, event_clock_reset,
      version="ntpd 4.2.8p4@1.3265-o Mon Oct 26 14:28:17 UTC 2015 (1)",
      processor="amd64", system="FreeBSD/10.1-RELEASE-p25", leap=00,
      stratum=2, precision=-23, rootdelay=25.191, rootdisp=67.854,
      refid=204.9.54.119,
      reftime=da31a5c9.235647a3  Fri, Jan  1 2016 20:26:33.138,
      clock=da31a622.b3b0f7cd  Fri, Jan  1 2016 20:28:02.701, peer=58444,
      tc=6, mintc=3, offset=-0.122, frequency=18.603, sys_jitter=22.813403,
      clk_jitter=12.192, clk_wander=0.000
      ntpq> q
      [root@freenas] ~# ntpdate -ud 10.1.1.1
      1 Jan 20:28:46 ntpdate[15064]: ntpdate 4.2.4p5-a (1)
      transmit(10.1.1.1)
      receive(10.1.1.1)
      transmit(10.1.1.1)
      receive(10.1.1.1)
      transmit(10.1.1.1)
      transmit(10.1.1.1)
      transmit(10.1.1.1)
      10.1.1.1: Server dropped: strata too high
      server 10.1.1.1, port 123
      stratum 16, precision -6, leap 11, trust 000
      refid [10.1.1.1], delay 0.02571, dispersion 24.01199
      transmitted 4, in filter 4
      reference time:    00000000.00000000  Thu, Feb  7 2036  1:28:16.000
      originate timestamp: da31a64e.39fe35ff  Fri, Jan  1 2016 20:28:46.226
      transmit timestamp:  da31a64f.3a2ea971  Fri, Jan  1 2016 20:28:47.227
      filter delay:  0.02571  0.04134  0.00000  0.00000
              0.00000  0.00000  0.00000  0.00000
      filter offset: 0.023948 -0.00004 0.000000 0.000000
              0.000000 0.000000 0.000000 0.000000
      delay 0.02571, dispersion 24.01199
      offset 0.023948

      1 Jan 20:28:48 ntpdate[15064]: no server suitable for synchronization found
      [root@freenas] ~#

      1 Reply Last reply Reply Quote 0
      • johnpozJ Offline
        johnpoz LAYER 8 Global Moderator
        last edited by

        you are using an older version of ntpdate.. Why don't you just update it?

        Current dev version is 4.3.88 it is syncing fine to pfsense ntp server

        user@clean:~$ ntpdate -d pfsense.local.lan
        1 Jan 21:46:42 ntpdate[29545]: ntpdate 4.3.88@1.2483 Mon Dec 28 22:23:20 UTC 2015 (1)
        Looking for host pfsense.local.lan and service ntp
        192.168.9.253 reversed to pfSense.local.lan
        host found : pfSense.local.lan
        transmit(192.168.9.253)
        receive(192.168.9.253)
        transmit(192.168.9.253)
        receive(192.168.9.253)
        transmit(192.168.9.253)
        receive(192.168.9.253)
        transmit(192.168.9.253)
        receive(192.168.9.253)
        server 192.168.9.253, port 123
        stratum 3, precision -18, leap 00, trust 000
        refid [192.168.9.253], delay 0.02600, dispersion 0.00003
        transmitted 4, in filter 4
        reference time:    da31c5f2.447ed54e  Fri, Jan  1 2016 21:43:46.267
        originate timestamp: da31c6a8.e20bc1c1  Fri, Jan  1 2016 21:46:48.882
        transmit timestamp:  da31c6a8.e1e17584  Fri, Jan  1 2016 21:46:48.882
        filter delay:  0.02606  0.02605  0.02606  0.02600
                0.00000  0.00000  0.00000  0.00000
        filter offset: 0.000203 0.000183 0.000202 0.000250
                0.000000 0.000000 0.000000 0.000000
        delay 0.02600, dispersion 0.00003
        offset 0.000250

        1 Jan 21:46:48 ntpdate[29545]: adjust time server 192.168.9.253 offset 0.000250 sec
        user@clean:~$

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • F Offline
          fatsailor
          last edited by

          Thanks for the help! I love being the first to find version mismatch bugs.

          Rather than update the entire office of OSX clients and Freenas servers to a newer version of ntpdate, I think we're just going to make ntpdate an alias to 'ntpd -qg -c <special config="">' or something along those lines. That way we don't have to worry about dependencies etc.

          I'll probably file a bug with Freenas also so someone else doesn't waste an afternoon chasing this one down.</special>

          1 Reply Last reply Reply Quote 0
          • johnpozJ Offline
            johnpoz LAYER 8 Global Moderator
            last edited by

            Dude but isn't 4.2.4p5 really really freaking old??  didn't 4.2.4p5 come out in like Aug of 2008??  What version of os x and freebsd are you running that that would be the ntp version?

            So help validate this, I grabbed an OLD version for windows - couldn't find the exact 4.2.4p5 but p8 pretty close, and yeah fails..

            oldversionntp.png
            oldversionntp.png_thumb

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • S Offline
              slu
              last edited by

              @fatsailor:

              stratum 16, precision -6, leap 11, trust 000

              See exactly the same with a older CentOS (guess 6.4) Server, Debian 7/8 works.

              pfSense Gold subscription

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                Yeah it looks like there is a issue between versions of ntp..  What version of ntp is the centos box running

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • S Offline
                  slu
                  last edited by

                  @johnpoz:

                  What version of ntp is the centos box running

                  Don't know which version was affected, now it is a CentOS 6.7 with ntp.x86_64 4.2.6p5-5.el6.centos.2 and it working as expected.

                  pfSense Gold subscription

                  1 Reply Last reply Reply Quote 0
                  • D Offline
                    David_W
                    last edited by

                    ntpdate is rather bitrotted and has been on the pathway to deprecation for some time.

                    Depending on the usage case, sntp or ntpd -gq should be used - the link in the previous paragraph gives some background and implementation considerations.

                    FreeBSD base system only abandoned ntp 4.2.4 in the second half of 2015.

                    1 Reply Last reply Reply Quote 0
                    • C Offline
                      charliem
                      last edited by

                      @fatsailor:

                      Rather than update the entire office of OSX clients and Freenas servers to a newer version of ntpdate, I think we're just going to make ntpdate an alias to 'ntpd -qg -c <special config="">' or something along those lines. That way we don't have to worry about dependencies etc.

                      I'll probably file a bug with Freenas also so someone else doesn't waste an afternoon chasing this one down.</special>

                      It was reported here that choosing certain parameters in NTP access restrictions would work around this bug in older ntpdate client versions.  I haven't tested myself, but if it works then you wouldn't have to touch each client.

                      Yes, 'ntpd -gq' is the right approach going forward, but it may not be practical to upgrade client machines.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        So looking at that thread.. And a simple test with old ntpdate, its the KOD packet that is killing the old version for some reason..

                        If you uncheck the Kiss-o'-death, then ntpdate from old client works… If you have it enabled then it fails with stratum 16, and leap 11

                        edit:  Seems if kod is enabled, it also places a limited in the restrictions, which is a conflict when you have no monitor set as well, which is in the conf file but don't see anyway in the gui to edit that.

                        Jan 5 04:05:38 ntpd[11014]: restrict: 'monitor' cannot be disabled while 'limited' is enabled

                        If you uncheck kod, then the kod is removed from the conf as well as the limited.

                        disable monitor
                        statsdir /var/log/ntp
                        logconfig =syncall +clockall +peerall +sysall
                        driftfile /var/db/ntpd.drift
                        restrict default nomodify nopeer notrap
                        restrict -6 default nomodify nopeer notrap

                        If you check the kod option in access restrictions you get
                        disable monitor
                        statsdir /var/log/ntp
                        logconfig =syncall +clockall +peerall +sysall
                        driftfile /var/db/ntpd.drift
                        restrict default kod limited nomodify nopeer notrap
                        restrict -6 default kod limited nomodify nopeer notrap

                        nokodworks.png
                        nokodworks.png_thumb
                        kodsetting.png
                        kodsetting.png_thumb

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • D Offline
                          David_W
                          last edited by

                          @johnpoz:

                          And a simple test with old ntpdate, its the KOD packet that is killing the old version for some reason..

                          If you uncheck the Kiss-o'-death, then ntpdate from old client works… If you have it enabled then it fails with stratum 16, and leap 11

                          In this case, kiss-of-death is working as intended, but ntpdate earlier that some time during the 4.2.7 cycle fails to understand it.

                          Dave Hart posted an excellent analysis of this scenario in the comp.protocols.time.ntp newsgroup.

                          I found:
                          discard average 6 minimum 0
                          got my ntp servers working with old ntpdate binaries and kiss-of-death enabled.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ Offline
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            why wouldn't you update vs downgrade..  I show it working with current ntpdate.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • D Offline
                              David_W
                              last edited by

                              @johnpoz:

                              why wouldn't you update vs downgrade..  I show it working with current ntpdate.

                              It's a compatibility thing. Nothing here runs ntp older than 4.2.8p4 (4.2.8p5 has just released), but there are circumstances where older remote clients need to run against my servers.

                              1 Reply Last reply Reply Quote 0
                              • H Offline
                                HeMaN
                                last edited by

                                Thank you for this topic. Was pulling my hair out why my Thecus nas was the only device not able to sync with time my pfsense box.
                                All test done from my windows pc showed no issues. Looking on the nas I found out it is not using ntpd / ntpq but ntpdate (ntpdate 4.2.4p8 to be exact)

                                throug a long way of searching came to this topic.

                                After setting "ACL - Custom Access Restrictions" in pfSense for the IP of my NAS and disabeling KOD, all is working fine

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ Offline
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Glad the topic was of use of you HeMan.. When I saw this show up as something new it - was at first ah shit some spammer necro an old thread ;)  Nice to see it was someone actual used the info contained in old threads for what they are meant for ;)

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.