Re: [Ntp] Symmetric mode

[Miroslav Lichvar <[e-mail]>]

On Thu, Sep 29, 2022 at 02:45:24AM -0700, Hal Murray wrote:
> If one side says "peer other" and the other side doesn't say anything I get 
> the symmetric active/passive pair you describe.
> 
> I was expecting an ephemeral slot to show up in ntpq -p but I haven't seen it. 
> Maybe I haven't got the restrict stuff right.  I tried
>   restrict default notrap
> with all other restrict stuff commented out.  Can anybody confirm that this 
> ephemeral association does or doesn't show up in ntpq -p?  Is crypto now 
> required?  ???

You need to either add "disable auth" to ntp.conf, or configure a
symmetric key on both hosts and add it to the peer directive.

ntpq -p (or ntpq -c peers) prints emphemeral symmetric associations,
but only if there was a valid response (reachable). If you just replay
a packet from a different address or port, the association will not be
printed by ntpq -c peers.

You need to use the ntpq -c lpeers command to see all associations,
but that works only up to a certain number of association which can be
listed in a single mode-6 response. There is also a limit due to the
16-bit type of the association ID. With more than 65535 associations
some will be completely invisible and other interesting things may
start to happen. I'd expect the daemon to crash at some point due to
running out of memory, or at least become so slow it's no longer doing
anything useful.

If you limit the addresses and port from which can be created
ephemeral associations, you get basically the same thing as a
permanent association.

-- 
Miroslav Lichvar