NTP Issue

johnpoz

@admacdo said in NTP Issue:

[bad udp cksum 0x5a6d

odd that all the traffic you send to 1.2 shows bad checksum??

But traffic from 1.2 to 1.1 shows ok?

Do you have your checksum offload on?

admacdo

@johnpoz
No checksum offload tick.

stephenw10

@admacdo said in NTP Issue:

No checksum offload tick.

'No tick' could imply it's not disabled and therefore is offloaded.

admacdo

@stephenw10
Yeah, bad explanation on my part. It's not disabled.
I even cycled it on and off a few times with a reboot to see if it made any difference.

No change.

I'm a little disappointed.

stephenw10

If it's actually disabled you can see that directly using ifconfig at the CLI, for example:

[24.08-DEVELOPMENT][admin@4200.stevew.lan]/root: ifconfig -m igc1
igc1: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=48020b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,HWSTATS,MEXTPG>
	capabilities=4f43fbb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWTSO,NETMAP,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>

Where tx and rx checksums are shown in capabilities but not options. Though you see vlan checkums are still enabled.

admacdo

@stephenw10

Well, it looks like it's not disabled, as all previous indications have said that it isn't.

igc2: flags=1008943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
description: LAN
options=4e020bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
capabilities=4f43fbb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWTSO,NETMAP,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
ether 60:be:b4:07:c6:16
inet 192.168.25.254 netmask 0xffffff00 broadcast 192.168.25.255
inet6 fe80::62be:b4ff:fe07:c616%igc2 prefixlen 64 scopeid 0x3
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
supported media:
media autoselect
media 2500Base-T
media 1000baseT
media 1000baseT mediaopt full-duplex
media 100baseTX mediaopt full-duplex
media 100baseTX
media 10baseT/UTP mediaopt full-duplex
media 10baseT/UTP
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

stephenw10

Ok then the checksum failure in a pcap is expected. That isn't really a problem normally though.

admacdo

Well, just for more fun, a couple of weeks ago, I bought an SG-1100 as I needed a backup firewall in case mine self toasts somehow.
I reset it to defaults, stuck a rough config on and as a quick test, pointed it at both my local NTP stratum one time servers and also time.apple.com.

The apple timeserver responded instantly and the 1100 totally ignored the two locals.

I updated it to the latest Pfsense Plus and the same thing happened.

Today I was given a VK-T40E2 by a colleague who'd upgraded his home firewall setup.
I reset it to defaults and configured it, then pointed it at the same three timeservers as the 1100.
It instantly latched onto one of the locals while still seeing the other two.
It was still on the original version, so I updated that to the latest legacy 2.3.5 (I think). Going further will require a complete reinstall and I don't have a null modem cable to hand these days.
It still saw all the local and internet NTP servers that I cared to list.

So of course, I can't wait to get it to 2.4 so that it can't see the two local stratum ones...
At least that's what I'm betting will happen.

Gertjan

@admacdo said in NTP Issue:

The apple timeserver responded instantly and the 1100 totally ignored the two locals.

It will put the other two as a 'hot spare'.
Check for yourself (example) :

Btw : look at that : NTP went IPv6 only also ...

@admacdo said in NTP Issue:

I updated it to the latest Pfsense Plus

24.11.

@admacdo said in NTP Issue:

the same three timeservers

Normally, you shouldn't use 3 'off something' (DNS, NTP, whatever) as it created problems.
See it like this : you have to buy a new car, but you want to think about it, so your interrogations @home and discuss it with your wive.
What would happen if you had 3 wives ?
I can tell you what will happen. You won't drive any car any soon (you couldn't afford one anyway ^^)

So :
NTP : pick a 'pool'.
DNS : stick to 'root servers' (a pool actually).
etc etc.

@admacdo said in NTP Issue:

latest legacy 2.3.5

An APU ? 32 bits ??

@admacdo said in NTP Issue:

it to 2.4 so

2.4 ?

admacdo

@Gertjan

Go and read the entire thread, start to finish. Pay particular attention to what I have already posted.
Go and read how NTP actually works.
Not SNTP.
The REAL complete NTP and learn EXACTLY WHY you put in multiple NTP sources.
Then maybe go and read why Industry Best Practice requires four.