On Fri, Oct 19, 2018 at 05:11:48PM -0500, Jason Rabel wrote: > I'm writing my own little query script to decode NTP packets and I've come > across some conflicting information in the RFCs and other white papers that > I'm hoping an authoritative source would know the answer to.
> Specifically for the 'Poll Interval' and 'Root Dispersion' fields in the > NTP packet, some documents say they are unsigned variables, others say they > are signed... The RFC 5905 (NTPv4) should be the authoritative source here. For the poll field it has: 8-bit signed integer representing the maximum interval between successive messages, in log2 seconds. For the root dispersion there is: The 32-bit short format is used in delay and dispersion header fields where the full resolution and range of the other formats are not justified. It includes a 16-bit unsigned seconds field and a 16-bit fraction field. So, poll is signed and root dispersion is unsigned. Which documents have conflicting information? I think ntpd internally uses an "unsigned" poll variable, but I'm not sure if it really is an issue as it doesn't support sub-second polling intervals. In tcpdump there was a bug that it printed the poll field as unsigned. That was fixed some time ago. > I can't think of a reason for Root Dispersion to be negative... 0 would be > the best and I think max is clamped to 16? The maximum is ~65536 seconds. Large values may be used by servers that have lost their time source. -- Miroslav Lichvar _______________________________________________ questions mailing list questions@lists.ntp.org http://lists.ntp.org/listinfo/questions
