D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Monitoring another machine's network traffic

 

Gordon Henderson wrote:
> 
> Hm. Thought of another - turn on firewalling on the router, block port
> 123, if it supports it and look at the logs...

You can usually just log on firewalls. If you block NTP the logs may not
be representative of normal NTP traffic, since the clients are often
adaptive and check external time less often after they have got the
"correct" time and calibrated their internal clocks.

I have seen a couple of cases where NTP when working uses little
bandwidth, but when the NTP fails, the clients retry far too often. One
of these was a Wireless Access Point, which had been configured to use
public time servers which had been decommissioned since it was
installed, but were happily sending a steady stream of packets out into
the great big Internet. Damn thing only took IP addresses (in the GUI -
Linux under the hood) so couldn't set to use something like the ntp pool
servers.

If the devices have configurable NTP settings you could just point these
either at your own NTP servers, or at boxes that forward the NTP
requests to appropriate servers, as another way of getting in the stream.

-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/linux_adm/list-faq.html