Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NTP not syncing with clients

    Scheduled Pinned Locked Moved General pfSense Questions
    ntpntpd
    15 Posts 6 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      Yo5hi @stephenw10
      last edited by

      @stephenw10 Yes, pfSense was syncing to that same list of pools. I just removed all of the other pools, as you suggested now though:

      fff084a8-8405-4b46-9bb4-1e11c8859deb-image.png

      ae8901dc-f865-497d-a070-08506670dad2-image.png

      If I run "ntpdate pool.ntp.org" from the command prompt on pfSense, I get the following (so it's synced since the offset is low):

      b3b90fad-440e-4f2e-bb98-71270a61dfc0-image.png

      After those changes and after waiting a bit for it to settle, here's the current NTP status:

      1b5d6332-0b4c-4c32-9e26-42befd70a097-image.png

      The NTP graph looks ok over time, too, I think:

      3553d430-a1d6-44a2-be05-d91cc1673308-image.png

      So I just ran a packet capture and noticed an odd behavior, which may mean something to you. I saw that one of my other devices requested an NTP sync and it worked:

      3c2acdbe-b48b-4967-ab35-ba03e7fcd4c8-image.png

      01c680e8-4225-421a-b40a-bdf2325f85b3-image.png

      Then, if I do the same with the device I am interested in, the following happens:

      Request:
      fccb257b-b3dd-442e-807b-11940bd892c3-image.png

      Response (Looks correct):
      288aea88-0879-4d6f-a1df-6ee17ed66beb-image.png

      But then the client does another request 5 seconds after (perhaps to confirm), yet now the pfSense NTP service only reports a 1970 timestamp and says "unsynchronized" (no longer stratum 3), and this then continues indefinitely (client request >> 1970 response >> client request >> etc.):

      401fe4ed-eb74-4c78-8e40-d3445d2c8c43-image.png

      f03b7b2f-e957-4897-8cb2-36182e975501-image.png

      So why does pfSense provide the correct time only once to the client, and then not again if the client requests a few seconds later? Is there some sort of minimum time allowed between requests?

      1 Reply Last reply Reply Quote 0
      • I
        Impatient
        last edited by

        Why do you have an o after your 0. us.pool.ntp it should be 0.us.pool.ntp.org

        stephenw10S 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan
          last edited by

          Not related :
          This :

          98a9d56c-5d6d-4e2d-8358-e00f066a5773-image.png

          is not needed as they already (hidden ;) ) exist as soon as you activate a DHCP server on that interface.
          This explains the leading 0/0.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          Y 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator @Impatient
            last edited by

            @Impatient said in NTP not syncing with clients:

            Why do you have an o after your 0. us.pool.ntp it should be 0.us.pool.ntp.org

            It's just the ntp output truncating it. You can see the actual urls are correct in the settings. Plus it's actually pulling IPs from the pool to connect to. 😉

            Steve

            1 Reply Last reply Reply Quote 0
            • Y
              Yo5hi @Gertjan
              last edited by

              @Gertjan Yep, that was just a residual sanity check. Removed it now.

              @stephenw10 Yeah, it's pulling IPs correctly from the pool and looks to be properly synchronizing the time, from the looks of the NTP service status page (screenshot above).

              Any idea why the NTP service will only send a valid timestamp after the initial request, and then no longer after that?

              I noticed that the client request looks different (e.g. Peer polling interval, Leap indicator) after the 1st request, but that may be how Wireshark is parsing the data:

              1st request:
              1st request

              Subsequent requests:
              Subsequent requests

              With NTP, is the client supposed to send its current timestamp with the request? The client, on boot, would have a timestamp of zero (so 1970), so is there something going on with the NTP service giving a null timestamp because the client's timestamp is substantially offset?

              GertjanG johnpozJ 2 Replies Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Hmm, not really I'm afraid. ntpd is a fickle beast!

                If you set the client time/date manually to something close to the real time does it then sync?
                I have seen clients that did that before.

                Steve

                1 Reply Last reply Reply Quote 0
                • GertjanG
                  Gertjan @Yo5hi
                  last edited by Gertjan

                  @Yo5hi said in NTP not syncing with clients:

                  The client, on boot, would have a timestamp of zero (so 1970)

                  The local clock is dead ?
                  IMHO, ntp syncs to correct small differences. Not decades. It would take centuries to bridge such a gap - NTP corrects using small portions.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @Gertjan
                    last edited by

                    @Gertjan said in NTP not syncing with clients:

                    The local clock is dead ?

                    Or more likely the CMOS battery. That's very common on older computers.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Yo5hi
                      last edited by johnpoz

                      @Yo5hi said in NTP not syncing with clients:

                      With NTP, is the client supposed to send its current timestamp with the request?

                      Yes..

                      here is my client starting its sync process..

                      client.png

                      You can see its currently not sync'd - will be back once it synced and show you the client packet

                      currently it has just stared

                      ntpq> pe
                           remote           refid      st t when poll reach   delay   offset  jitter
                      ==============================================================================
                      *ntp.local.lan   .PPS.            1 u   62   64    7    0.623   -1.238   0.930
                      

                      edit: ok now showing sync'd, notice the leap indicator went away..and showing reach of 377, and have * next to the server

                      ntpq> pe
                           remote           refid      st t when poll reach   delay   offset  jitter
                      ==============================================================================
                      *ntp.local.lan   .PPS.            1 u    5   64  377    0.632   +0.357   0.325
                      

                      sync.png

                      I would really suggest if you can just run the ntp client on it, so you can get lots of info of what is going on with just the ntpq command

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      JKnottJ 1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott @johnpoz
                        last edited by

                        @johnpoz said in NTP not syncing with clients:

                        I would really suggest if you can just run the ntp client on it, so you can get lots of info of what is going on with just the ntpq command

                        One thing you have to watch for, in the name of security bogus times are sometimes used. However, they apparently don't cause problems.

                        Check through this capture to see some examples of those bogus times.

                        NTP.pcapng

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • Y
                          Yo5hi
                          last edited by

                          I just manually set the time on the IoT device (it doesn't have a RTC on board or a CMOS) and had it try to sync with the NTP service and got the same behavior. From the packets, it appears that the NTP service on pfSense is throwing some sort of error in the "Reference ID" field though (detailed below).

                          Client's first sync request (it doesn't put its current timestamp in, apparently, even though I set it manually before the sync):
                          e5beaa2f-dde0-4a37-bace-9284da9ad30d-image.png

                          Server's response (looks correct):
                          d53faf1f-3ac9-4080-a211-d75c5a339060-image.png

                          Client makes another request 5 seconds later with some differences to 1st request for some reason:
                          d333583c-462d-4f88-b10f-bc7569041a69-image.png

                          Server response, but now has "Unidentified reference source 'RATE'" and reports and invalid stratum of zero:
                          06cef95b-9670-4260-8c42-fb5a22ccf61c-image.png

                          I don't see anything in the System Logs for the NTP service that's an error or anything, and the NTP monitoring data looks fine (within 7ms over the last 24hrs, if I am interpreting it correctly):

                          a25dd250-9c95-443e-8054-70b220903845-image.png

                          What does "Unidentified reference source 'RATE'" mean?

                          1 Reply Last reply Reply Quote 0
                          • Y
                            Yo5hi
                            last edited by

                            Ok, I had a feeling that it was something to do with rate limiting, or the rate that the client is trying to poll the server, so I slowed down the frequency that the client performs retries to sync the clock from every 5 seconds to every 20 seconds and it reliably syncs now after 3-4 attempts.

                            So it appears that there's some sort of rate limiting or something about NTP that doesn't allow clients to poll it more often than 20 secs or so.

                            So it's working now - I just wish that my devices don't have to wait 60-80 secs on boot to sync.

                            Thanks for the help, everyone.

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Yo5hi
                              last edited by

                              @Yo5hi said in NTP not syncing with clients:

                              I just wish that my devices don't have to wait 60-80 secs on boot to sync.

                              So, it boots, asks the time ones - got it, and sets it's own clock, and wants be sure and checks up a second time. It pauses the entire system while waiting for that ??

                              No RTC, bad NTP implementation ... hummm.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.