Debugging NTP issue with packet sniffer

RouterOS General
1

Hi,

I am struggling with an NTP issue since a long time and I am not able to solve it. I have an main router RB3011 which is connected to the internet by PPPoE/VDSL.
It receives its time by an external NTP Server. This works like a charm, the NTP client says sychronized. Now I want to distribute this time to my local network (192.168.0.0/24).
The local IP of my main router is 192.168.0.254. I have enabled the NTP Server on this main router and now I am expecting that the clients in the local network which can ping
my main router are able to receive the time via NTP server 192.168.0.254. But it does not work. This is the main issue which I cannot solve. I thought to try another way, because I am stuck here.


For debugging purpose I tried to use another Mikrotik device in my network (192.168.0.212). There I tried to get SNTP Client running. As time server I am now using an
external NTP server (ptbtime1.ptb.de). The logs tell my that the SNTP client tries to send the query to ptbtime1.ptb.de(I see them in the sniffer leaving the device) but it does not get any reply. My first thought was that
the main router is filtering the NTP UDP traffice because pinging my main router works. So I use packet sniffer to sniff all port 123 packets on all interface on the
main router (192.168.0.254). To my astonishment I did not see any port 123 packets arriving there?! Is there somewhere a filter which drops packets before even the sniffer can see them?

Finally I suppose an context between the not working NTP server on the main router and invisible NTP packets arriving on the main router… Any ideas how to continue?

Thanks a lot!

Regards Toby

2

Hello

If you want to see ntp traffic, add a firewall rule with:
Chain=input
Protocol=UDP
Dst.port=123
Action=log

Make sure it’s on top and you’ll see everything for ntp. Add the proper in interface to see only internal requests.

I’m not in front of a router, but check to see if your ntp server has multicast enabled. If so, Try unchecking it.



Sent from my cell phone. Sorry for the errors.

3

Thanks for your reply. Well I see leaving NTP Packets on my Win10 machine with target IP main router with NTP Server(192.168.0.254). On the router I have set this log rule and I can see arriving NTP packets but not from the win10 machine (192.168.0.110). As mentioned ping and everything else is working…

Any ideas where my Mikrotik Router is discarding packets?

4

I am a bit lost in your “main router” and “other router” topology. Does the main router run the default SNTP package (which only allows it to run as an NTP client) or have you replaced it with the NTP package (which allows other devices to get NTP information from it)? Have you added the rule suggested by @Alain to the main router (which is supposed to act as a server for the NTP clients) or to the “other router” which stands between the client and the “main” router (which would easily explain why it logs nothing there as it is in the input chain)?

Other than that, there should be nothing that could prevent incoming packets from being sniffed. So if you cannot see NTP packets while sniffing on the port to which your Windows machine is connected, they are not coming from the Windows machine, dot. If the “other router” is between the Windows machine and the “main router”, the firewall of the “other router” may drop them. Only the configuration export will allow us to tell more.

5

You won’t belive what causes this issue :open_mouth: :open_mouth: :open_mouth: It were two HP switches!

One HP 1810-24G and another HP 1820-24G.
There is a feature called “Storm Control” and “Auto DoS”. Both were enabled.
Disabling it solves the issue, all NTP Clients are working now!

WTF… I have been investing round about 50h debugging this issue :frowning:

And it solved another issue, now Winbox finds my Neighbors again :smiley:

[edit]
Some Google Chromecast issues are now solved too. :smiley: :smiley: I think a lot of users out there could have the same spurious issues.