<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 8/6/18 19:45, Paul Theodoropoulos wrote:<br>
<blockquote type="cite"
cite="mid:c7db58bc-39c4-ff3a-9537-dda96404f619@anastrophe.com">The
utterly incomprehensible transmit timestamps of packets outbound
in my tcpdump output is the one that really sends a chill down my
spine. At first blush, it makes me think I'm spewing deadly
packets to timeservers all over the place.
<br>
</blockquote>
<br>
So, I am seeing most packets making sense, not sending timestamps
way in the past or future. But there still are such packets. <br>
<br>
Watching them go by, I note that I have not seen any with dates
outside of the 'prime epoch' of January 1, 1900, and the timescale
overflow date of 2036. Which tells me that while they do appear
bizarre and nonsensical, they seem to be rooted somewhere in
rationality.<br>
<br>
But I see a fair share of stuff like this - <br>
<br>
<tt>22:44:01.451036 IP (tos 0x0, ttl 54, id 0, offset 0, flags [DF],
proto UDP (17), length 76)</tt><tt><br>
</tt><tt> stratum-1.sjc02.svwh.net.ntp >
ntpsec.anastrophe.com.ntp: [udp sum ok] NTPv4, length 48</tt><tt><br>
</tt><tt> Server, Leap indicator: (0), Stratum 1 (primary
reference), poll 3 (8s), precision -16</tt><tt><br>
</tt><tt> Root Delay: 0.000000, Root dispersion: 0.000366,
Reference-ID: CDMA</tt><tt><br>
</tt><tt> Reference Timestamp: 3742609434.076817000
(2018/08/06 22:43:54)</tt><tt><br>
</tt><tt> Originator Timestamp: 3791701072.751951859
(2020/02/26 02:17:52)</tt><tt><br>
</tt><tt> Receive Timestamp: 3742609441.392657608
(2018/08/06 22:44:01)</tt><tt><br>
</tt><tt> Transmit Timestamp: 3742609441.437230000
(2018/08/06 22:44:01)</tt><tt><br>
</tt><tt> Originator - Receive Timestamp:
-49091631.359294251</tt><tt><br>
</tt><tt> Originator - Transmit Timestamp:
-49091631.314721859</tt><br>
<br>
or this to another machine on my LAN:<br>
<br>
<tt>22:49:09.198136 IP (tos 0xb8, ttl 64, id 1296, offset 0, flags
[DF], proto UDP (17), length 508)</tt><tt><br>
</tt><tt> ntpsec.anastrophe.com.ntp > klaatu.39235: [udp sum
ok] NTPv2, length 480</tt><tt><br>
</tt><tt> Reserved, Leap indicator: (0), Stratum 162
(reserved), poll 0 (1s), precision 3</tt><tt><br>
</tt><tt> Root Delay: 37140.207382, Root dispersion:
0.007141, Reference-ID: 115.114.99.97.static-Chennai.vsnl.net.in</tt><tt><br>
</tt><tt> Reference Timestamp: 1685208369.196154486
(1953/05/27 10:26:09)</tt><tt><br>
</tt><tt> Originator Timestamp: 842477106.219454775
(1926/09/12 13:25:06)</tt><tt><br>
</tt><tt> Receive Timestamp: 544436835.439200547
(1917/04/03 00:27:15)</tt><tt><br>
</tt><tt> Transmit Timestamp: 1026634291.172370162
(1932/07/14 00:11:31)</tt><tt><br>
</tt><tt> Originator - Receive Timestamp:
-298040270.780254228</tt><tt><br>
</tt><tt> Originator - Transmit Timestamp:
+184157184.952915386</tt><br>
<br>
Am I broken, or do these packets make any actual sense?
<pre class="moz-signature" cols="72">--
Paul Theodoropoulos
<a class="moz-txt-link-abbreviated" href="http://www.anastrophe.com">www.anastrophe.com</a></pre>
</body>
</html>