[ntp:questions] Detecting ntp broadcast packets

2019-02-26 Thread John Thurston
We don't run any ntp broadcast server. We don't have any intention of running one. In fact, I'd like to know if any such signal ever appears on my network. Two ideas I had: A) create a host with an ntpd 'broadcastclient' and then monitor its log output to see if it ever found a signal. B) us

Re: [ntp:questions] Detecting ntp broadcast packets

2019-02-27 Thread Miroslav Lichvar
On Tue, Feb 26, 2019 at 09:58:06AM -0900, John Thurston wrote: > B) use snoop or tcpdump to look at broadcast packets and tell me if it > uncovers any ntp > > Is there already a better way to watch and warn of such packets? An easier way would be to use tcpdump to print all NTP packets (not just

Re: [ntp:questions] Detecting ntp broadcast packets

2019-02-28 Thread John Thurston
On 2/26/2019 11:34 PM, Miroslav Lichvar wrote: On Tue, Feb 26, 2019 at 09:58:06AM -0900, John Thurston wrote: B) use snoop or tcpdump to look at broadcast packets and tell me if it uncovers any ntp Is there already a better way to watch and warn of such packets? An easier way would be to use

Re: [ntp:questions] Detecting ntp broadcast packets

2019-02-28 Thread Miroslav Lichvar
On Wed, Feb 27, 2019 at 08:39:45AM -0900, John Thurston wrote: > And since I'm on a switched ethernet LAN, my network port is only going to > see traffic destined for my own MAC (or broadcast) anyway. So I really can't > see any benefit to enabling promiscuous mode. What am I missing? Nothing. I w