D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Monitoring another machine's network traffic

 

On Wed, 25 Nov 2009, Grant Sewell wrote:

On Thu, 12 Nov 2009 14:55:52 +0000
Grant Sewell wrote:

Hi all,

We have some energy-monitoring networked devices in the office and we
need to know how frequently our devices request NTP (UDP#123) info.
Is there anyway to monitor another machine's network traffic from a
Linux machine?

Cheers.
Grant. :)

OK, I've decided to put myself in the stream... I want to install an
NTP service on the underused virtual Linux server (Debian Stable) and
have our "networked device" contact that for NTP info.

I have installed ntp and my /etc/ntp.conf file looks like this:
--- BEGIN NTP.CONF FILE ---
driftfile /var/lib/ntp/ntp.drift
statsdir /var/log/ntpstats/
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
server uk.pool.ntp.org iburst
server europe.pool.ntp.org iburst
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1
restrict 192.168.1.0 mask 255.255.255.0 notrust nomodify notrap
--- END NTP.CONF FILE ---

Hm. it's a bit verbose, isn't it?

All you really need to get going is one line:

  server  uk.pool.ntp.org

And you can list that 2 or 3 times as 'uk.pool.ntp.org' is several machines. The rest of the file is config flab.

Once it's going with the basics, then you can add in the other stuff, if you need. Most of it is about premissions and logging, but lets face it, you'll never read the log-files and you're behind a firewall...

However...

When I run "ntpdate -q [ip address of server]" from my Ubuntu laptop it
says: "no server suitable for synchronization found".  When I run
"ntpdate -q localhost" on the server, it shows the service is accepting
connections via localhost.

If you can run ntpdate then ntp isn't running, and if ntp isn't running then you won't be providing time services.

  # ps ax | fgrep ntp
   2852 ?        Ss     0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -g

You ought to see something like that from ps ax | fgrep ntp

nmap doesn't show NTP as a running service, when queried either locally
or remotely.

What am I doing wrong?

Not starting ntp.

Try this: (as root)

  ntpdate -b uk.pool.ntp.org

  /etc/init.d/ntp start

If this whinges, then check syslog for why.

then:

  ntpq -c rl

Look for "stratum=XX" in the output - usually at the end of the 3rd line down.

also:

  ntpq -c peers

and it'll tell you what it's synced to.



--
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/linux_adm/list-faq.html