I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.

yuza@VirtualBox:~$ sudo timedatectl set-ntp off && timedatectl status 
                      Local time: Fri 2019-04-12 09:59:28 CEST
                  Universal time: Fri 2019-04-12 07:59:28 UTC
                        RTC time: Fri 2019-04-12 07:59:29
                       Time zone: Europe/Vienna (CEST, +0200)
       System clock synchronized: yes
systemd-timesyncd.service active: no
                 RTC in local TZ: no

Still, wireshark captures frequently NTP traffic.
I am aware of wiresharks capture filter and display filter.
Nevertheless, I am interested why I cannot disable NTP using sudo timedatectl set-ntp off?

I don't have chrony installed:

yuza@VirtualBox:~$ apt policy chrony | grep Installed
  Installed: (none)

Screenshot of wireshark capture: NTP_Wireshark_Capture

List of files opened by process of UDP port 123:

yuza@VirtualBox:~$ sudo lsof -iUDP:123
ntpd    716  ntp   16u  IPv6  19895      0t0  UDP *:ntp 
ntpd    716  ntp   17u  IPv4  19900      0t0  UDP *:ntp 
ntpd    716  ntp   18u  IPv4  19904      0t0  UDP localhost:ntp 
ntpd    716  ntp   19u  IPv6  19906      0t0  UDP ip6-localhost:ntp 
ntpd    716  ntp   23u  IPv4  22229      0t0  UDP VirtualBox:ntp 
ntpd    716  ntp   24u  IPv6  22232      0t0  UDP VirtualBox:ntp 
  • 1
    running chrony? – Rui F Ribeiro Apr 15 at 8:00
  • 2
    timedatectl set-ntp controls systemd-timesyncd.service, but that is not the only possible way to synchronize the system clock. There is chrony mentioned by Rui F Ribeiro, and the classic ntpd. There may be others. The NTP protocol uses UDP in port 123: sudo lsof -i udp:123 should tell you which process is using that port on your system. – telcoM Apr 15 at 9:48

Finally I discovered the problem.
Additionally to sudo timedatectl set-ntp off, I also had to execute the command sudo /etc/init.d/ntp stop. After doing so, sudo lsof -iUDP:123 shows me no more UDP-port-123 processes which were active before. And wireshark does not capture any NTP traffic anymore.

yuza@VirtualBox:~$ sudo /etc/init.d/ntp status | grep "Active:"
   Active: active (running) since Tue 2019-04-16 14:58:03 CEST; 5s ago
yuza@VirtualBox:~$ sudo /etc/init.d/ntp stop
[ ok ] Stopping ntp (via systemctl): ntp.service.
yuza@VirtualBox:~$ sudo /etc/init.d/ntp status | grep "Active:"
   Active: inactive (dead) since Tue 2019-04-16 14:58:14 CEST; 3s ago
yuza@VirtualBox:~$ sudo lsof -iUDP:123

Thanks to telcoM for the hint!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.