How to know which IPs are querying my ntp server?

[MD Shafiullah]

I have a linux ntp server. I want to know which servers are doing query to my ntp server. I want to know the IP address. Can anyone help how to do that?

[Steven E. Protter]

Shalom,

If logged ntp queries are logged to /var/log/messages.

There are logging options available in the ntp.conf file

SEP

[Sajjad Sahir]

Dear MD

u have to check the logs there is no other option.
more /var/log/messages

thanks and regards

Sajjad Sahir

[MD Shafiullah]

I have checked /var/log/messeges but found no entry for ntp query. I could find which IPs are querying my ntp server by getting a tcpdump and then filtering out all except ntp request packets. Then found out how many IPs were querying the NTP server.

Is there any other way?

[Armin Kunaschik]

Start xntpd with the -d option. See man page for more detail. If you don't want to do so, you can setup a nettl monitoring for udp port 123.

My 2 cents,
Armin

PS: Please assign points if you find answers useful!

[Ivan Krastev]

Use tcpdump to see the udp trafic as well:

# tcpdump udp port 123


regards,
ivan

[Suraj K Sankari]

Hi,

Check the /var/log/messages file
or do netstat -a | grep -i ntp

Suraj