[ntp:questions] ntpdc monlist codes seeked
Ronan Flood
usenet at umbral.org.uk
Mon Feb 26 15:03:49 UTC 2007
On Fri, 23 Feb 2007 23:14:34 +0100,
WOLfgang Schricker <news at wols.org> wrote:
> 'ntpdc -c version -nc monlist ' gives me
> ntpdc 4.2.2p3 at 1.1577-o Mi Okt 4 04:38:25 UTC 2006 (1)
>
> and nine columns
> remote address
> port
> local address
> count
> m
> ver
> code
> avgint
> lstint
> Especially required are 'm'ode- and 'code'-codes ;-)
'm'ode is the mode seen in the packet from the remote address/port,
defined in ntp.h:
MODE_UNSPEC 0 /* unspecified (old version) */
MODE_ACTIVE 1 /* symmetric active mode */
MODE_PASSIVE 2 /* symmetric passive mode */
MODE_CLIENT 3 /* client mode */
MODE_SERVER 4 /* server mode */
MODE_BROADCAST 5 /* broadcast mode */
MODE_CONTROL 6 /* control mode [ntpq] */
MODE_PRIVATE 7 /* private mode [ntpdc] */
> A 'ntpdc -nc monlist' query gives the code '194' and a client's
> query gives '80' if they are OK. But all other versions?
'code' is a hex value made up of flag bits from the entry matching
the remote address in the restrict list (ntpdc -nc reslist), again
defined in ntp.h:
RES_IGNORE 0x001 /* ignore packet */
RES_DONTSERVE 0x002 /* access denied */
RES_DONTTRUST 0x004 /* authentication required */
RES_VERSION 0x008 /* version mismatch */
RES_NOPEER 0x010 /* new association denied */
RES_LIMITED 0x020 /* packet rate exceeded */
RES_NOQUERY 0x040 /* mode 6/7 packet denied */
RES_NOMODIFY 0x080 /* mode 6/7 modify denied */
RES_NOTRAP 0x100 /* mode 6/7 set trap denied */
RES_LPTRAP 0x200 /* mode 6/7 low priority trap */
RES_DEMOBILIZE 0x400 /* send kiss of death packet */
RES_TIMEOUT 0x800 /* timeout this entry */
I don't think RES_TIMEOUT is used in the monlist/reslist functions,
and RES_LIMITED only appears in the monlist code if the remote has
exceeded either of the rate limits.
So in your examples 80 = nomodify, 194 = notrap+nomodify+nopeer+notrust
'lstint' is the time in seconds since the most recent packet from
the remote was seen. I think that column is misnamed actually, and
'last' would be more appropriate. The others should be obvious.
--
Ronan Flood <usenet at umbral.org.uk>
More information about the questions
mailing list