This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

NTP: uncalibrated local clock

0

I have a Windows 2003 DC (NTP3) that has a Cisco router as its time source on the same LAN. Recently, 2003 server stopped getting replies from the router, however if I change the time source to any external NTP server, the sync problem goes away.

Filtering for NTP traffic wireshark sees (NTP symmetric active) requests from the server to the Cisco router, but nothing comes back. (assuming NTP symmetric passing should be seen)

alt text

when it says "uncalibrated local clock", does it mean uncalibrated local clock used as a primary reference for a subnet without external means of synchronization ?

http://www.faqs.org/rfcs/rfc2030.html

Thanks

asked 07 Dec '10, 07:43

net_tech's gravatar image

net_tech
116303337
accept rate: 13%

edited 07 Dec '10, 07:50


One Answer:

0

I think this is simply the current reference source of the server that is sending the ntp traffic. The Cisco may not respond if it is not synchronized, though it has nothing to do with the Reference ID in this packet (as you stated it is going from the windows server to the NTP server. Since it is the DC, there is some time function that the server is holding. Therefore it is "used as a primary reference fore a subnet" and since it is synchronized it is "uncalibrated and without external means of sync"

Take a look at the status of the NTP on the Cisco if you have access by issuing the following commands:

show ntp status

show ntp associations

show ntp associations detail

answered 07 Dec '10, 17:31

Paul%20Stewart's gravatar image

Paul Stewart
3018
accept rate: 6%

edited 07 Dec '10, 17:32