[time] originator timestamp 1947?
Wed Feb 7 00:50:50 UTC 2007
J.A.C.M. (Jos) van de Ven wrote:
> Here are some packets I recieved:
> Transmit Timestamp: 3077626362.219461950 (1997/07/11 18:12:42)
> Transmit Timestamp: 1514075493.973285183 (1947/12/25 01:31:33)
> Transmit Timestamp: 2067499402.738687015 (1965/07/08 10:23:22)
> Transmit Timestamp: 3681652601.341220243 (2016/08/31 19:16:41)
> Transmit Timestamp: 51884613.470888538 (2037/09/29 20:51:49)
> All those timestamps in the far past and future? Does this look right?
> I didn't even show you all the packets, but it is just an example.
If I remember correctly, some (S)NTP client software implementations
randomize the transmit timestamp in purpose even if they know the
approximate time. They use it as a kind of simple cookie/authenticator
for received NTP packets. A server copies the transmit timestamp from a
received NTP packet into the originator timestamp of the reply packet as
is, so the client that sent the query can compare the originator
timestamp to the timestamp it used in the query. This can in some cases
prevent spoofing of the NTP reply packets. AFAIK, one of these
implementations is the "SNTP" daemon used in/shipped with openbsd.
More information about the pool