0

I am capturing DHCP packets with tcpdump. The client sends a DHCP request asking for the DHCP configuration which contains a request for NTP servers but in the DHCP ACK message sent by the router there is no NTP server information. Shouldn't the server answer with the NTP server's IPs as it does with the domain name servers? What am I missing?

In case that the device is not getting NTP servers' addresses through DHCP because my home router does not support it, where can it get the NTP server that it is using from? It is not a manually configured parameter, is there any other service for getting NTP servers automatically?

The system uses connman as connection manager

I attatch screen shots of the request and ack messages

tcpdump command used:

tcpdump -i eth0 -n port 67 and port 68 -w capture.pcap -v

DHCP REQUEST

DHCP REQUEST

DHCP ACKNOWLEDGE

DHCP ACK

  • 2
    Show your dhcpd.conf. – Ipor Sircer Jul 3 '18 at 13:34
  • The device does not use dhcpd, it uses connman – jap jap Jul 3 '18 at 13:37
  • 1
    Instead use pool.ntp.org if your device does not return NTP servers as part of its DHCP config. – thrig Jul 3 '18 at 13:45
  • Thanks @thrig but what I am trying to figure out is where the NTP server that the device is using comes from – jap jap Jul 3 '18 at 15:47
0

1) The DHCP server will only answer with an NTP server field if it is configured to do that. From your dumps, it looks like it isn't, so this is a dead end.

2) The device will use whatever it likes as an NTP server - there's no general rule. Very likely somewhere on the device is a config file which contains the NTP server(s) it uses.

3) If you know enough about the device to say that it uses connman: Do you have access to the device as root? Or can you see the file system? If yes, look at all configuration files you can find.

4) If the device is some closed embedded device you don't have access to, another option is to monitor all traffic from the device until it contacts an NTP server, and then you'll know. Wireshark/tcpdump with a proper rule to filter for NTP traffic will do. If you can connect the device to a single custom AP or LAN port (e.g. on some Linux PC), that will make monitoring easier; but as you are already able to dump the DHCP requests + responses, it should also work that way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.