<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
On 4/8/2024 22:50 PM, Hal Murray via users wrote:
<blockquote type="cite"
cite="mid:20240409055017.136D728C002@107-137-68-211.lightspeed.sntcca.sbcglobal.net"><span
style="white-space: pre-wrap">
</span>
<pre class="moz-quote-pre" wrap="">The Ethernet MTU (max packet size) is 1500. Round down for a couple of
headers and you get 1472. The Internet spec is 512. (Or something like
that.) But (almost) everybody supports 1500.
NTP with NTS packets are a couple hundred bytes -- much biffer than 48, but
well below 1500, even with 7 extra cookies.
There is a strange case that I don't think anybody has tracked down. Some
router (maybe many) drop NTP+NTS packets with 1, 2, or 3 extra cookies but
work with 4.
I don't have a good story for why netcat work but ntp+nts doesn't. Did you
try both directions? Or from port 123 to port 123? [My head hurts trying to
dance around NAT.]
</pre>
</blockquote>
Yes, agreed on the head hurting. As my later message acknowledged, I
was seeing MTU at work. I was thinking the authenticated packets
were larger than MTU, and "fun" ensuing from that, but as you say
they're less than 1500 even w/cookies.<br>
<br>
I did glean this from a long tcpdump -<br>
<br>
22:46:44.212917 IP 172-089-174-168.res.spectrum.com.ntp >
a-ntpsec.ntp: NTPv4, Client, length 48<br>
22:46:44.213246 IP a-ntpsec.ntp >
172-089-174-168.res.spectrum.com.ntp: NTPv4, Server, length 48<br>
22:46:44.728639 IP a-ntpsec.ntp > oregon.time.system76.com.ntp:
NTPv4, Client, length 956<br>
22:46:45.728637 IP a-ntpsec.ntp > time.txryan.com.ntp: NTPv4,
Client, length 924<br>
22:46:47.728639 IP a-ntpsec.ntp > time.cifelli.xyz.ntp: NTPv4,
Client, length 924<br>
22:47:00.728358 IP a-ntpsec.ntp > ntp1.net.berkeley.edu.ntp:
NTPv4, Client, length 48<br>
22:47:00.748122 IP ntp1.net.berkeley.edu.ntp > a-ntpsec.ntp:
NTPv4, Server, length 48<br>
<br>
so, a normal exchange of NTP data for an NTP client, then my server
sends "large" but less-than-MTU authenticated packets to the three
NTS servers...but gets no reply. <br>
<br>
For now, I'm going to sleep on it. Appreciate your indulgence thus
far.<br>
<pre class="moz-signature" cols="74">--
Paul Theodoropoulos
<a class="moz-txt-link-abbreviated" href="http://www.anastrophe.com">www.anastrophe.com</a></pre>
</body>
</html>