NTP server issues

stephenw10

There is a difference between having a host resolve as a local IP and redirecting to the same local IP though.

Perhaps the switches are using some ntp authentication and will only sync to Netgear's pool? It would be the first time I've seen that though.

Run a packet capture and find out. Whatever they are using it's clearly on port 123 since redirecting that breaks it. Should be easy enough to capture.

Steve

johnpoz

pfsense is a standard ntp service - running the latest version 4.2.8p14.. Anything designed to use ntp would work...

There is nothing fancy about gs108v3 - pretty sure I have one of those on the shelf even..

Yup, sure do... Give me a sec to plug it in and sent its ntp up...

Ok - the GS108Ev3 doesn't even have time settings..

JKnott

@johnpoz said in NTP server issues:

I have never seen a device hard code an IP for ntp... They always use either a vendor fqdn, pool, or other tqdn.

My tablet does that. I have an Asus Zenpad 10 which uses 5.144.132.2.123 for ntp. The host command does not return a host name.

host 5.144.132.2.123
Host 5.144.132.2.123 not found: 3(NXDOMAIN)

There is no ntp setting on this tablet that I can find.

johnpoz

5-144-132-2.static.hostiran.name

That is IP in Iran...

Why would they hard code an IP in iran? That makes ZERO sense!!

its part of the pool for global, asia and iran..
https://www.ntppool.org/scores/5.144.132.2

So what is likely is you missed the query where it found that IP via dns via a query to ntp pool..

You would have to be a complete an utter moron to hard code an IP for some mass produced device to use.. When if that IP goes away, what if can not run ntp on it. What if you sell 10 million devices that all now point to a single IP, etc. etc..

They query a pool fqdn, and pick and IP.. or multiples from this pool..

But its clear why his switch gs108Ev3 can not sync time - is because it has no settings for that at all.. It has no log that I can see.. so what point of time would it have?

JKnott

@johnpoz said in NTP server issues:

So what is likely is you missed the query where it found that IP via dns via a query to ntp pool..

Actually, I did watch for DNS when I first noticed that and didn't see any. Also, if it queried pool.ntp.org, it should have got an address on my LAN, as I have a host override to point to my pfSense firewall.

It's not the first time I've seen a manufacturer do something stupid. Seems to me there's a switch & AP manufacturer that couldn't do VLANs right.

4o4rh

@johnpoz I have the pro version, you have the plus. You don't seem to have many of the features that i have.
Time is under System, Management, Time. But like i say, you are missing a whole bunch of stuff like switching, routing, qos, etc

johnpoz

@JKnott said in NTP server issues:

it should have got an address on my LAN

How do you know it didn't query asia.pool.ntp.org or 0.pool.ntp.org, 1.pool.ntp.org, do you have a wildcard setup?

Again any sntp client could query the ntp service that pfsense is running... It is the the ntp server that owns the internet to be honest.. Sniff the traffic.. What do you see.

4o4rh

@JKnott i removed all timeservers except for the pfsense box and i am getting TCP 66 to 52.211.208.165

JKnott

@johnpoz

While you were posting that, I checked again and it is indeed querying asia.pool.ntp.org. I don't know how I missed that before.

This is one example of where using Wireshark is better than Packet Capture. With Wireshark I can filter on both DNS and NTP at the same time, along with the MAC address, whereas Packet Capture can only filter on 1 protocol at a time, along with MAC or IP address.

Still, given that the tablets are used around the world, it would be better if they just used pool.ntp.org, instead of asia.pool.ntp.org. Using pool.ntp.org will provide a regional address.

Guess it's time for another host override.

johnpoz

yup same sort of nonsense with my smart plugs using uk.pool ;) hehehe

you can download the pcap.. Your pfsense box sure and the F is not 52.211.x.x is it??

That is a aws IP, and is not in the pool.

And I don't show it answering ntp.. And TCP is not what sntp or ntp uses.. anyway. Are you trying to say port tcp 66 to that IP? That sure and the hell has nothing to do with time. Or is the packet size... sniff on port 123 UDP.. And then open it in wireshark - attach a copy..

4o4rh

@johnpoz how can i export just the 4 ntp lines from wireshark
ntp client
ntp server
ntp client
ntp server

johnpoz

Attache the pcap.. If you sniffed on 123 and the IP of your switch all that would be in there is its query for ntp and answers.

JKnott

@johnpoz

I often filter on the MAC, to capture both IPv4 and IPv6.

johnpoz

Thats fine - is is switch running IPv6.. He made no mention of that.. Here is query from my pc to my ntp server.. That captured with pfsense

Since its routed from my lan to my segment my pi ntp server sites in.

ntp.pcap

You can download that and open in wireshark as example of ntp query and answer.

4o4rh

@johnpoz ntp_dump.pcap i notice in the two server entries, the first one is giving the address 127.0.0.1 and the second says unidentified reference source 'rate'

johnpoz

That shows that your ntp on pfsense is not in sync... Show us the status of ntp on pfsense.

Here is what typical should look like

Says right there that your clock is unsynced

So no - no clients at all should sync with that..

4o4rh

@johnpoz

johnpoz

So pfsense can not talk to any ntp servers, so no shit nobody is going to be able to sync time with it.

your reach needs to be 377... And looks like you hae those set as pool placeholders... But they prob never resolved.

example

4o4rh

@johnpoz i had the interface set to all the LAN/VLAN addresses. Now i changed it to the WAN/VPN and chugging.

johnpoz

Ok once you see it in sync.. Then your switch should sync with it... But when it is unsync like that, no ntp client would sync.

You changed it to what? Your ntp services doesn't need to listen on your wan/vpn... You mean your dns was not using your wan/vpn to resolve with?