[ntp:questions] NTPv4 Peer Event Codes - secret decoder ring sought

[Dave Hart]

On Mar 17, 03:30 UTC, Joseph Gwinn wrote:
> Looking in section B.2.2 of RFC 1305 yields that the Peer Status Field has four
> subfields, the last (rightmost) one of which being the 4-bit Peer Event Code
> (page 57), which is defined for values between 0 and 5, and is "reserved" for
> values 6 to 15.
>
> Well, I have been seeing two values of Peer Status, 9614 and 963a, both
> hexidecimal.  I understand 9614, but 963A is a mystery, as it implies a Peer
> Event Code of 10 (the "A" in the rightmost digit), which is undefined and
> reserved in RFC 1305.  

Scan for "PEVNT_" in ntp.h:

http://ntp.bkbits.net:8080/ntp-stable/include/ntp.h?PAGE=anno&REV=4af5f8cfDBBhNWjyJ4XiD74vlioxeg

#define	PEVNT_MOBIL	(1 | PEER_EVENT) /* mobilize */
#define	PEVNT_DEMOBIL	(2 | PEER_EVENT) /* demobilize */
#define	PEVNT_UNREACH	(3 | PEER_EVENT) /* unreachable */
#define	PEVNT_REACH	(4 | PEER_EVENT) /* reachable */
#define	PEVNT_RESTART	(5 | PEER_EVENT) /* restart */
#define	PEVNT_REPLY	(6 | PEER_EVENT) /* no reply */
#define	PEVNT_RATE	(7 | PEER_EVENT) /* rate exceeded */
#define	PEVNT_DENY	(8 | PEER_EVENT) /* access denied */
#define PEVNT_ARMED	(9 | PEER_EVENT) /* leap armed */
#define	PEVNT_NEWPEER	(10 | PEER_EVENT) /* sys peer */
#define	PEVNT_CLOCK	(11 | PEER_EVENT) /* clock event */
#define	PEVNT_AUTH	(12 | PEER_EVENT) /* bad auth */
#define	PEVNT_POPCORN	(13 | PEER_EVENT) /* popcorn */
#define	PEVNT_XLEAVE	(14 | PEER_EVENT) /* interleave mode */
#define	PEVNT_XERR	(15 | PEER_EVENT) /* interleave error */
#define	PEVNT_TAI	(16 | PEER_EVENT) /* TAI */

To match the literal text output by ntpd/ntpq when decoding, see also
libntp/statestr.c:

http://ntp.bkbits.net:8080/ntp-stable/libntp/statestr.c?PAGE=anno&REV=4ac6e036jH41_maMfVXyf2VeiFknzQ

There may be an easier way, but looking at the source comes naturally
to me.

Cheers,
Dave Hart