Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP not syncing with clients

    General pfSense Questions
    ntp ntpd
    6
    15
    2.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by

      Not related :
      This :

      98a9d56c-5d6d-4e2d-8358-e00f066a5773-image.png

      is not needed as they already (hidden ;) ) exist as soon as you activate a DHCP server on that interface.
      This explains the leading 0/0.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      Y 1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator @Impatient
        last edited by

        @Impatient said in NTP not syncing with clients:

        Why do you have an o after your 0. us.pool.ntp it should be 0.us.pool.ntp.org

        It's just the ntp output truncating it. You can see the actual urls are correct in the settings. Plus it's actually pulling IPs from the pool to connect to. 😉

        Steve

        1 Reply Last reply Reply Quote 0
        • Y
          Yo5hi @Gertjan
          last edited by

          @Gertjan Yep, that was just a residual sanity check. Removed it now.

          @stephenw10 Yeah, it's pulling IPs correctly from the pool and looks to be properly synchronizing the time, from the looks of the NTP service status page (screenshot above).

          Any idea why the NTP service will only send a valid timestamp after the initial request, and then no longer after that?

          I noticed that the client request looks different (e.g. Peer polling interval, Leap indicator) after the 1st request, but that may be how Wireshark is parsing the data:

          1st request:
          1st request

          Subsequent requests:
          Subsequent requests

          With NTP, is the client supposed to send its current timestamp with the request? The client, on boot, would have a timestamp of zero (so 1970), so is there something going on with the NTP service giving a null timestamp because the client's timestamp is substantially offset?

          GertjanG johnpozJ 2 Replies Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Hmm, not really I'm afraid. ntpd is a fickle beast!

            If you set the client time/date manually to something close to the real time does it then sync?
            I have seen clients that did that before.

            Steve

            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @Yo5hi
              last edited by Gertjan

              @Yo5hi said in NTP not syncing with clients:

              The client, on boot, would have a timestamp of zero (so 1970)

              The local clock is dead ?
              IMHO, ntp syncs to correct small differences. Not decades. It would take centuries to bridge such a gap - NTP corrects using small portions.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @Gertjan
                last edited by

                @Gertjan said in NTP not syncing with clients:

                The local clock is dead ?

                Or more likely the CMOS battery. That's very common on older computers.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @Yo5hi
                  last edited by johnpoz

                  @Yo5hi said in NTP not syncing with clients:

                  With NTP, is the client supposed to send its current timestamp with the request?

                  Yes..

                  here is my client starting its sync process..

                  client.png

                  You can see its currently not sync'd - will be back once it synced and show you the client packet

                  currently it has just stared

                  ntpq> pe
                       remote           refid      st t when poll reach   delay   offset  jitter
                  ==============================================================================
                  *ntp.local.lan   .PPS.            1 u   62   64    7    0.623   -1.238   0.930
                  

                  edit: ok now showing sync'd, notice the leap indicator went away..and showing reach of 377, and have * next to the server

                  ntpq> pe
                       remote           refid      st t when poll reach   delay   offset  jitter
                  ==============================================================================
                  *ntp.local.lan   .PPS.            1 u    5   64  377    0.632   +0.357   0.325
                  

                  sync.png

                  I would really suggest if you can just run the ntp client on it, so you can get lots of info of what is going on with just the ntpq command

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @johnpoz
                    last edited by

                    @johnpoz said in NTP not syncing with clients:

                    I would really suggest if you can just run the ntp client on it, so you can get lots of info of what is going on with just the ntpq command

                    One thing you have to watch for, in the name of security bogus times are sometimes used. However, they apparently don't cause problems.

                    Check through this capture to see some examples of those bogus times.

                    NTP.pcapng

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • Y
                      Yo5hi
                      last edited by

                      I just manually set the time on the IoT device (it doesn't have a RTC on board or a CMOS) and had it try to sync with the NTP service and got the same behavior. From the packets, it appears that the NTP service on pfSense is throwing some sort of error in the "Reference ID" field though (detailed below).

                      Client's first sync request (it doesn't put its current timestamp in, apparently, even though I set it manually before the sync):
                      e5beaa2f-dde0-4a37-bace-9284da9ad30d-image.png

                      Server's response (looks correct):
                      d53faf1f-3ac9-4080-a211-d75c5a339060-image.png

                      Client makes another request 5 seconds later with some differences to 1st request for some reason:
                      d333583c-462d-4f88-b10f-bc7569041a69-image.png

                      Server response, but now has "Unidentified reference source 'RATE'" and reports and invalid stratum of zero:
                      06cef95b-9670-4260-8c42-fb5a22ccf61c-image.png

                      I don't see anything in the System Logs for the NTP service that's an error or anything, and the NTP monitoring data looks fine (within 7ms over the last 24hrs, if I am interpreting it correctly):

                      a25dd250-9c95-443e-8054-70b220903845-image.png

                      What does "Unidentified reference source 'RATE'" mean?

                      1 Reply Last reply Reply Quote 0
                      • Y
                        Yo5hi
                        last edited by

                        Ok, I had a feeling that it was something to do with rate limiting, or the rate that the client is trying to poll the server, so I slowed down the frequency that the client performs retries to sync the clock from every 5 seconds to every 20 seconds and it reliably syncs now after 3-4 attempts.

                        So it appears that there's some sort of rate limiting or something about NTP that doesn't allow clients to poll it more often than 20 secs or so.

                        So it's working now - I just wish that my devices don't have to wait 60-80 secs on boot to sync.

                        Thanks for the help, everyone.

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @Yo5hi
                          last edited by

                          @Yo5hi said in NTP not syncing with clients:

                          I just wish that my devices don't have to wait 60-80 secs on boot to sync.

                          So, it boots, asks the time ones - got it, and sets it's own clock, and wants be sure and checks up a second time. It pauses the entire system while waiting for that ??

                          No RTC, bad NTP implementation ... hummm.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.