1

I'm running a Unix server with NTPD version 4.2.7. I have various clients using this as its main NTP server such as other unix servers, cameras, IOT devices, etc. I want to get a list of which IPs are using this NTP server to find out which clients would be affected if this UX server went down. The below is what I get when running ntpdc -c monlist, not what I expected, expected information on clients using this as their NTP server.

server# ntpdc -c monlist
***Server reports data not found

Thank you all.

  • What kind of UNIXis it running? GNU/Linux, Solaris, AIX, HP-UX, Irix, ? – Jeff Schaller May 1 at 13:57
  • 1
    monlist was removed quite a while ago because of the way it could be trivially used as a DoS amplification attack. I haven't yet found something else that lists clients, only peers. – roaima May 1 at 14:11
  • Solaris 11. Perhaps a snoop command may be sufficient? – Strainger May 1 at 14:39
  • 1
    A host-based firewall "log-only" rule is where I was going, yes. – Jeff Schaller May 1 at 14:42
1

There isn't a clean solution to this problem. NTP communication happens over UDP therefore it is stateless, hence you can't check established connections.

What you can do without much effort is cook a tcpdump/tshark filter to keep track of connections over time. What I mean by that is sniffing the network and observe any NTP traffic, specifically client to server traffic. This will give you an accurate list of NTP clients but isn't something you can query at any time - it is a process that needs to be kept running for a while (or idefinitely, depending on the purpose).

Conversely, chronyd (which also implements part of the NTP protocol) does keep track of connecting clients. If this is a viable alternative for your case, it will help you solve this problem.

| improve this answer | |
  • Following your thought process I will run a command and gather data over time. The below command is what I ended up gathering. I will mark your answer as correct. Thank you. snoop -qr -d (interface name) | grep (NTP Server IP) | grep NTP | tee (outputfile) – Strainger May 1 at 15:41
  • sounds reasonable. tcpdump, snoop, ngrep, etc, pick your poison :) – Pedro May 1 at 16:05
  • Thanks for your help Pedro – Strainger May 1 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.