Re: [Ntp] Symmetric mode

[Hal Murray <[e-mail]>]

[e-mail] said:
> I realized over the weekend that people have misunderstood how symmetric
> mode works and think that there is just one packet exchange between  peers.
> That is incorrect. That's not how it works.

> Symmetric mode works almost identically to client/server modes on the  wire.
> The only difference is that client/server use modes 3 and 4 while  symmetric
> peer use mode 1 or 2 depending on whether these are active or  passive modes.
> You should see no difference on the wire between  client/server and symmetric
> modes except for the mode value. 

 From https://doc.ntp.org/documentation/4.2.8-series/assoc/
> A symmetric active peer sends a symmetric active (mode 1) message to a
> designated peer. If a matching configured symmetric active association is
> found, the designated peer returns a symmetric active message. If no matching
> association is found, the designated peer mobilizes a ephemeral symmetric
> passive association and returns a symmetric passive (mode 2) message. Since
> an intruder can impersonate a symmetric active peer and cause a spurious
> symmetric passive association to be mobilized, symmetric passive mode should
> always be cryptographically validated.

I setup a test case using ntpd 4.3.99

If both sides peer each other, I see symmetric active going both ways at the 
polling interval with no immediate response.  ntpq -p shows happiness but the 
bottom bit of reach is often not set.  This is the half-bandwidth case I was 
expecting.

If one side says "peer other" and the other side doesn't say anything I get 
the symmetric active/passive pair you describe.

I was expecting an ephemeral slot to show up in ntpq -p but I haven't seen it. 
Maybe I haven't got the restrict stuff right.  I tried
  restrict default notrap
with all other restrict stuff commented out.  Can anybody confirm that this 
ephemeral association does or doesn't show up in ntpq -p?  Is crypto now 
required?  ???



-- 
These are my opinions.  I hate spam.