I'm running a Unix server with NTPD version 4.2.7. I have various clients using this as its main NTP server such as other unix servers, cameras, IOT devices, etc. I want to get a list of which IPs are using this NTP server to find out which clients would be affected if this UX server went down. The below is what I get when running ntpdc -c monlist, not what I expected, expected information on clients using this as their NTP server.

server# ntpdc -c monlist
***Server reports data not found

Thank you all.

  • What kind of UNIXis it running? GNU/Linux, Solaris, AIX, HP-UX, Irix, ?
    – Jeff Schaller
    May 1, 2020 at 13:57
  • 1
    monlist was removed quite a while ago because of the way it could be trivially used as a DoS amplification attack. I haven't yet found something else that lists clients, only peers. May 1, 2020 at 14:11
  • Solaris 11. Perhaps a snoop command may be sufficient?
    – Strainger
    May 1, 2020 at 14:39
  • 1
    A host-based firewall "log-only" rule is where I was going, yes.
    – Jeff Schaller
    May 1, 2020 at 14:42

2 Answers 2


There isn't a clean solution to this problem. NTP communication happens over UDP therefore it is stateless, hence you can't check established connections.

What you can do without much effort is cook a tcpdump/tshark filter to keep track of connections over time. What I mean by that is sniffing the network and observe any NTP traffic, specifically client to server traffic. This will give you an accurate list of NTP clients but isn't something you can query at any time - it is a process that needs to be kept running for a while (or idefinitely, depending on the purpose).

Conversely, chronyd (which also implements part of the NTP protocol) does keep track of connecting clients. If this is a viable alternative for your case, it will help you solve this problem.

  • Following your thought process I will run a command and gather data over time. The below command is what I ended up gathering. I will mark your answer as correct. Thank you. snoop -qr -d (interface name) | grep (NTP Server IP) | grep NTP | tee (outputfile)
    – Strainger
    May 1, 2020 at 15:41
  • sounds reasonable. tcpdump, snoop, ngrep, etc, pick your poison :)
    – Pedro
    May 1, 2020 at 16:05
  • Thanks for your help Pedro
    – Strainger
    May 1, 2020 at 16:24

Open /etc/inet/ntp.conf and comment the line "disable monitor".

#disable monitor

After that restart ntp with:

svcadm restart ntp

and the ntpdc -c monlist command should display the client connections.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .