[ntp:questions] Conflicting information on packet field types

Miroslav Lichvar mlichvar at redhat.com
Tue Oct 23 08:26:45 UTC 2018

On Fri, Oct 19, 2018 at 05:11:48PM -0500, Jason Rabel wrote:
> I'm writing my own little query script to decode NTP packets and I've come
> across some conflicting information in the RFCs and other white papers that
> I'm hoping an authoritative source would know the answer to.

> Specifically for the 'Poll Interval' and 'Root Dispersion' fields in the
> NTP packet, some documents say they are unsigned variables, others say they
> are signed...

The RFC 5905 (NTPv4) should be the authoritative source here. For the
poll field it has:

  8-bit signed integer representing the maximum interval between
  successive messages, in log2 seconds.

For the root dispersion there is:

  The 32-bit short format is used in delay and dispersion header fields
  where the full resolution and range of the other formats are not
  justified.  It includes a 16-bit unsigned seconds field and a 16-bit
  fraction field.

So, poll is signed and root dispersion is unsigned.

Which documents have conflicting information? I think ntpd internally
uses an "unsigned" poll variable, but I'm not sure if it really is an
issue as it doesn't support sub-second polling intervals.

In tcpdump there was a bug that it printed the poll field as unsigned.
That was fixed some time ago.

> I can't think of a reason for Root Dispersion to be negative... 0 would be
> the best and I think max is clamped to 16?

The maximum is ~65536 seconds. Large values may be used by servers
that have lost their time source.

Miroslav Lichvar

More information about the questions mailing list