Re: ntp issues

Hi there,

On Fri, 21 Jul 2017, Network Administrator wrote:

> Inside the Green interface NTP time requests to 0.us.pool.ntp.org are
> taking a long time, then timing out ...

I've snipped a lot of the followup information because some of it's a
little confusing, but it seems probable that non-syncing machines on
the GREEN network are trying to use the dodgy IPCop for name service
but are unable to resolve the IP addresses for the pool time servers.
To test if that's true, at a shell prompt on a Linux box connected to
the GREEN network run a command to query the IPCop DNS server:

dig +short @<IP.Cop.IP.address> 0.us.pool.ntp.org

which *should* give output something like I get here on my laptop:

laptop3:~$ >>> dig +short @blast 0.us.pool.ntp.org
108.61.73.243
154.16.245.246
216.229.4.69
45.56.123.24

In the above example command I used 'blast', the name of my local
nameserver, but you should use the IP address of the GREEN interface
on your dodgy IPCop box.

If you get replies then more investigation is required, but my guess
is that you'll get a timeout error.  All you have to do then is find
out why those DNS requests from the GREEN net are not being serviced
which should be fairly straightforward.

This is something like what a timeout error would look like:

laptop3:~$ >>> dig +short @localhost 0.us.pool.ntp.org
;; connection timed out; no servers could be reached

In this case I asked dig to use 'localhost' for the name service, but
my laptop (a) doesn't run a nameserver and (b) doesn't know the name
(i.e. the name isn't in /etc/hosts, nor anywhere else on the laptop).

I'm guessing that your Linux servers are using their own nameservers,
and the other devices you mentioned are probably using hard-coded DNS
servers or time servers or at least not trying to use IPCop for DNS,
which is I guess why they are syncing OK.

If you're managing a lot of machines which sync time it's a good idea
to get on top of this, or you might become a nuisance and find you're
being firewalled by the time services etc. that you're trying to use.

Generally speaking I avoid using 100.0.0/8 for anything if I can, lots
of 10.0.0.0/8 addresses seem to leak out onto the public Internet.

-- 

73,
Ged.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user