[ntp:questions] Conflicting information on packet field types
mlichvar at redhat.com
Tue Oct 23 08:26:45 UTC 2018
On Fri, Oct 19, 2018 at 05:11:48PM -0500, Jason Rabel wrote:
> I'm writing my own little query script to decode NTP packets and I've come
> across some conflicting information in the RFCs and other white papers that
> I'm hoping an authoritative source would know the answer to.
> Specifically for the 'Poll Interval' and 'Root Dispersion' fields in the
> NTP packet, some documents say they are unsigned variables, others say they
> are signed...
The RFC 5905 (NTPv4) should be the authoritative source here. For the
poll field it has:
8-bit signed integer representing the maximum interval between
successive messages, in log2 seconds.
For the root dispersion there is:
The 32-bit short format is used in delay and dispersion header fields
where the full resolution and range of the other formats are not
justified. It includes a 16-bit unsigned seconds field and a 16-bit
So, poll is signed and root dispersion is unsigned.
Which documents have conflicting information? I think ntpd internally
uses an "unsigned" poll variable, but I'm not sure if it really is an
issue as it doesn't support sub-second polling intervals.
In tcpdump there was a bug that it printed the poll field as unsigned.
That was fixed some time ago.
> I can't think of a reason for Root Dispersion to be negative... 0 would be
> the best and I think max is clamped to 16?
The maximum is ~65536 seconds. Large values may be used by servers
that have lost their time source.
More information about the questions