[ntp:questions] Conflicting information on packet field types

[Jason Rabel]

I'm writing my own little query script to decode NTP packets and I've come
across some conflicting information in the RFCs and other white papers that
I'm hoping an authoritative source would know the answer to.

Specifically for the 'Poll Interval' and 'Root Dispersion' fields in the
NTP packet, some documents say they are unsigned variables, others say they
are signed...

I would think both would be unsigned, however I believe Chrony can set
negative poll intervals in its configuration for sub-second querying, but I
don't know if it tries to send that negative value in its NTP packets. The
largest poll interval allowed is 17, so even if it was decoded as a signed
field it would (should) never have an issue.

I can't think of a reason for Root Dispersion to be negative... 0 would be
the best and I think max is clamped to 16?

Thoughts?

[Miroslav Lichvar]

Post by Jason Rabel
I'm writing my own little query script to decode NTP packets and I've come
across some conflicting information in the RFCs and other white papers that
I'm hoping an authoritative source would know the answer to.
Specifically for the 'Poll Interval' and 'Root Dispersion' fields in the
NTP packet, some documents say they are unsigned variables, others say they
are signed...

The RFC 5905 (NTPv4) should be the authoritative source here. For the
poll field it has:

8-bit signed integer representing the maximum interval between
successive messages, in log2 seconds.

For the root dispersion there is:

The 32-bit short format is used in delay and dispersion header fields
where the full resolution and range of the other formats are not
justified. It includes a 16-bit unsigned seconds field and a 16-bit
fraction field.

So, poll is signed and root dispersion is unsigned.

Which documents have conflicting information? I think ntpd internally
uses an "unsigned" poll variable, but I'm not sure if it really is an
issue as it doesn't support sub-second polling intervals.

In tcpdump there was a bug that it printed the poll field as unsigned.
That was fixed some time ago.

Post by Jason Rabel
I can't think of a reason for Root Dispersion to be negative... 0 would be
the best and I think max is clamped to 16?

The maximum is ~65536 seconds. Large values may be used by servers
that have lost their time source.