[ntp:security] [ntp:hackers] receive: Unexpected origin timestamp

Kurt Roeckx kurt at roeckx.be
Sun Oct 25 10:06:19 UTC 2015


On Sun, Oct 25, 2015 at 07:12:05AM +0000, Harlan Stenn wrote:
> Kurt,
> 
> I haven't studied things carefully.
> 
> In your packet capture you say the last packet triggers an error.
> 
> The packet capture you sent contains:
> 
> client packet
> server packet
> ...
> client packet
> server packet
> server packet
> 
> so it's alternating client/server packets until the last packet, which
> is an apparently unsolicited server packet.
> 
> If this is the case, it's a feature that you're getting the warning
> message on that last packet.
> 
> But we'll keep digging to be sure.
> 
> Regardless, this will help a lot, thanks!

It's one of the last 2, I suspect it's actually the 2nd last that
cause the warning.


Kurt



More information about the security mailing list