D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Monitoring another machine's network traffic

 

On Thu, 12 Nov 2009, Simon Waters wrote:

Gordon Henderson wrote:

Hm. Thought of another - turn on firewalling on the router, block port
123, if it supports it and look at the logs...

You can usually just log on firewalls. If you block NTP the logs may not
be representative of normal NTP traffic, since the clients are often
adaptive and check external time less often after they have got the
"correct" time and calibrated their internal clocks.

I have seen a couple of cases where NTP when working uses little
bandwidth, but when the NTP fails, the clients retry far too often. One
of these was a Wireless Access Point, which had been configured to use
public time servers which had been decommissioned since it was
installed, but were happily sending a steady stream of packets out into
the great big Internet. Damn thing only took IP addresses (in the GUI -
Linux under the hood) so couldn't set to use something like the ntp pool
servers.

It was a DLink I think...

If the devices have configurable NTP settings you could just point these
either at your own NTP servers, or at boxes that forward the NTP
requests to appropriate servers, as another way of getting in the stream.

uk.pool.ntp.org.

I have a home made radio-clock (plugged into rs232 port), that I used to keep online to get a stratum one clock, but when I moved it from Bristol to Devon it stopped working. Probably something to do with the amount of granite that surrounds my house )-:

(Although wifeys alarm clock is radio synced from the MSF Anthorn thingy... Hm. maybe I ought to try it again)

Gordon

--
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/linux_adm/list-faq.html