[EMAIL PROTECTED] (Luc Pardon) writes:

> Frank Kardel wrote:
>> You are not NATting anything ? A broken NAT config/device could give this 
>> too if other systems from your network do queries that get mapped
>> to your primary system - but that's just a guess. Just like forged send IP 
>> would be. Maybe you could double check at your outgoing link
>> (inner and outer interface) for correlations like that.
>
>     None of the internal systems should query outside servers. And even if 
> they did, they should not have started doing that all of a sudden a week or 
> so ago. Never say never, though, so I double-checked already, in various 
> ways. I'm pretty sure it's not coming from behind my back.
ok.

>
>     What I don't control is the ADSL router in front of me, though. If my 
> friendly ISP decided last week that it would be nice to sync it to that 
> belbone server, and if they forward the replies right through to the network 
> behind, then that might be the cause.
>
>     In fact, there is an indication that this might be what's going on. Here 
> is a tcpdump of one such reply:
>
>  > 19:59:19.083130 ntp1.belbone.be.ntp > adsl-gida.ntp:  v1 server strat 2 
> poll 0 prec -20 (DF) [tos 0x10]
>
>     Note that it says "v1"... That's not in reply to an (x)ntp request.
very old version indeed (sntp?).

>
>     If it is indeed the router, the master of time at belbone would see 
> requests coming in from over here (this is why I double-checked they're not 
> mine <g>). I haven't heard back from them, but then they said they're working 
> on things. If they see queries, it'll be time to call my ISP.
>
This is probably beyond the point where I can help.
 
>
>>>     The strange packets are no longer coming in and in any case, I don't 
>>> have the resources right now to hook up a Linux box with a more recent 
>>> kernel to see what would happen.
>>>
>> Well, at least things did a bit improve, didn't they :-) ?
>> 
>
>      The glass is either half full or half empty. It's just that I like to 
> get at the bottom of things, both problems and glasses. I hate problems that 
> disappear unsolved, almost as much as I hate glasses that disappear 
> unfinished <g>.
>
>     But yes, we're making progress and that's a Good Thing indeed.

Well I hope you get to the bottom of the paket source and find full glasses :-)

>
>     Luc Pardon

Frank

_______________________________________________
questions mailing list
[email protected]
https://lists.ntp.isc.org/mailman/listinfo/questions

Reply via email to