[ntp:questions] requestor's time; transmit timestamp?

Nelson Minar nelson at monkey.org
Sun Nov 27 00:24:58 UTC 2005


I run a server in pool.ntp.org. I'm doing some analysis on the
requests I get. I'd like to know what time my clients think it is.

In an NTP request which timestamp carries the requestor's notion of
what time it is?

Looking at my packet traces I think the requestor's notion of time
must be stored in what ethereal/tcpdump call "Transmit Time Stamp". In
the responses my server sends it copies this timestamp into the
"Originate Time Stamp" field in the response and puts its own current
time in the "Receive Time Stamp" (and very soon thereafter, the
Transmit Time Stamp).


Do I have this right? Some of the docs I've found online describe it
differently. I've been reading about and using NTP for 15 years and I
still get confused by this stuff! Oy!


Just to clarify, here's a tethereal request and response. From this I
infer that the requestor thinks it's Sep 16, 2005 07:07:55.1693 UTC,
and my server is telling it it's Sep 16, 2005 07:07:55.2240 UTC.
Factoring in delay, we more or less agree on what time it is.

Frame 1 (90 bytes on wire, 90 bytes captured)
    Arrival Time: Sep 16, 2005 07:07:55.223935000
    Time delta from previous packet: 0.000000000 seconds
    Time since reference or first frame: 0.000000000 seconds
    Frame Number: 1
    Packet Length: 90 bytes
    Capture Length: 90 bytes
    Protocols in frame: eth:ip:udp:ntp
Ethernet II, Src: Cisco_f8:cf:ff (00:0d:bc:f8:cf:ff), Dst: Intel_66:96:35 (00:0e:0c:66:96:35)
    Destination: Intel_66:96:35 (00:0e:0c:66:96:35)
    Source: Cisco_f8:cf:ff (00:0d:bc:f8:cf:ff)
    Type: IP (0x0800)
Internet Protocol, Src: 65.171.219.241 (65.171.219.241), Dst: 72.36.170.170 (72.36.170.170)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 76
    Identification: 0x296e (10606)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 118
    Protocol: UDP (0x11)
    Header checksum: 0x0ac8 [correct]
    Source: 65.171.219.241 (65.171.219.241)
    Destination: 72.36.170.170 (72.36.170.170)
User Datagram Protocol, Src Port: 51066 (51066), Dst Port: ntp (123)
    Source port: 51066 (51066)
    Destination port: ntp (123)
    Length: 56
    Checksum: 0x97f5 [correct]
Network Time Protocol
    Flags: 0x19
        00.. .... = Leap Indicator: no warning (0)
        ..01 1... = Version number: NTP Version 3 (3)
        .... .001 = Mode: symmetric active (1)
    Peer Clock Stratum: secondary reference (2)
    Peer Polling Interval: 4 (16 sec)
    Peer Clock Precision: 0.015625 sec
    Root Delay:    0.0937 sec
    Clock Dispersion:    0.5920 sec
    Reference Clock ID: 200.23.51.205
    Reference Clock Update Time: Sep 16, 2005 04:11:13.3765 UTC
    Originate Time Stamp: Sep 15, 2005 07:45:02.2587 UTC
    Receive Time Stamp: Sep 15, 2005 07:45:03.3921 UTC
    Transmit Time Stamp: Sep 16, 2005 07:07:55.1693 UTC

Frame 2 (90 bytes on wire, 90 bytes captured)
    Arrival Time: Sep 16, 2005 07:07:55.224010000
    Time delta from previous packet: 0.000075000 seconds
    Time since reference or first frame: 0.000075000 seconds
    Frame Number: 2
    Packet Length: 90 bytes
    Capture Length: 90 bytes
    Protocols in frame: eth:ip:udp:ntp
Ethernet II, Src: Intel_66:96:35 (00:0e:0c:66:96:35), Dst: Cisco_f8:cf:ff (00:0d:bc:f8:cf:ff)
    Destination: Cisco_f8:cf:ff (00:0d:bc:f8:cf:ff)
    Source: Intel_66:96:35 (00:0e:0c:66:96:35)
    Type: IP (0x0800)
Internet Protocol, Src: 72.36.170.170 (72.36.170.170), Dst: 65.171.219.241 (65.171.219.241)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x10 (DSCP 0x04: Unknown DSCP; ECN: 0x00)
        0001 00.. = Differentiated Services Codepoint: Unknown (0x04)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 76
    Identification: 0x1179 (4473)
    Flags: 0x04 (Don't Fragment)
        0... = Reserved bit: Not set
        .1.. = Don't fragment: Set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: UDP (0x11)
    Header checksum: 0x18ad [correct]
    Source: 72.36.170.170 (72.36.170.170)
    Destination: 65.171.219.241 (65.171.219.241)
User Datagram Protocol, Src Port: ntp (123), Dst Port: 51066 (51066)
    Source port: ntp (123)
    Destination port: 51066 (51066)
    Length: 56
    Checksum: 0x10b5 [incorrect, should be 0x87db]
Network Time Protocol
    Flags: 0x1a
        00.. .... = Leap Indicator: no warning (0)
        ..01 1... = Version number: NTP Version 3 (3)
        .... .010 = Mode: symmetric passive (2)
    Peer Clock Stratum: secondary reference (3)
    Peer Polling Interval: 4 (16 sec)
    Peer Clock Precision: 0.000001 sec
    Root Delay:    0.0561 sec
    Clock Dispersion:    0.0424 sec
    Reference Clock ID: 67.18.58.210
    Reference Clock Update Time: Sep 16, 2005 07:03:22.3182 UTC
    Originate Time Stamp: Sep 16, 2005 07:07:55.1693 UTC
    Receive Time Stamp: Sep 16, 2005 07:07:55.2240 UTC
    Transmit Time Stamp: Sep 16, 2005 07:07:55.2240 UTC




More information about the questions mailing list