[time] originator timestamp 1947?

Tapio Sokura oh2kku
Wed Feb 7 00:50:50 UTC 2007


J.A.C.M. (Jos) van de Ven wrote:
> Here are some packets I recieved:
>           Transmit Timestamp:   3077626362.219461950 (1997/07/11 18:12:42)
>           Transmit Timestamp:   1514075493.973285183 (1947/12/25 01:31:33)
>           Transmit Timestamp:   2067499402.738687015 (1965/07/08 10:23:22)
>           Transmit Timestamp:   3681652601.341220243 (2016/08/31 19:16:41)
>           Transmit Timestamp:   51884613.470888538 (2037/09/29 20:51:49)
> 
> All those timestamps in the far past and future? Does this look right?
> I didn't even show you all the packets, but it is just an example.

If I remember correctly, some (S)NTP client software implementations 
randomize the transmit timestamp in purpose even if they know the 
approximate time. They use it as a kind of simple cookie/authenticator 
for received NTP packets. A server copies the transmit timestamp from a 
received NTP packet into the originator timestamp of the reply packet as 
is, so the client that sent the query can compare the originator 
timestamp to the timestamp it used in the query. This can in some cases 
prevent spoofing of the NTP reply packets. AFAIK, one of these 
implementations is the "SNTP" daemon used in/shipped with openbsd.

   Tapio



More information about the pool mailing list