From Newsgroup: comp.protocols.time.ntp

I have been updating many of my computers to Debian Trixie which uses
ntpd 1.2.3 (as ntpsec)

I'm having a problem with one of the two machines not starting ntpd
properly. A second machine using the same configuration file is behaving normally.

I have two servers on my network, one at 10.0.0.1 and one at 10.0.0.141
(which contains a GPS so it is preferred)

In the ntp.conf file I have them set up as well as other configuration options:


driftfile /var/lib/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list
server 10.0.0.1 iburst minpoll 3
server 10.0.0.141 iburst minpoll 3 prefer
restrict -4 default kod notrap nomodify nopeer noquery limited
restrict 127.0.0.1
restrict source notrap nomodify noquery


Attempting to start ntpd fails so I've run a debug output. I am able to
use ntpdate to set the clock on this machine but I can't start ntpd. Any
help understanding what might be happening would be appreciated.


# ntpd -d -d -g -n
2025-12-29T11:25:21 ntpd[3218]: INIT: ntpd ntpsec-1.2.3: Starting 2025-12-29T11:25:21 ntpd[3218]: INIT: Command line: ntpd -d -d -g -n 2025-12-29T11:25:21 ntpd[3218]: INIT: set_process_priority: Leave
priority alone
2025-12-29T11:25:21 ntpd[3218]: INIT: precision = 3.000 usec (-18) 2025-12-29T11:25:21 ntpd[3218]: INIT: successfully locked into RAM 2025-12-29T11:25:21 ntpd[3218]: CONFIG: readconfig: parsing file: /etc/ntpsec/ntp.conf
Finished Parsing!!
2025-12-29T11:25:21 ntpd[3218]: CONFIG: restrict notrap ignored 2025-12-29T11:25:21 ntpd[3218]: CONFIG: restrict nopeer ignored
getnetnum given 0.0.0.0, got 0.0.0.0
getnetnum given 0.0.0.0, got 0.0.0.0
restrict: op 1 addr 0.0.0.0 mask 0.0.0.0 mflags 00000000 flags 000004e0 getnetnum given 10.0.0.0, got 10.0.0.0
getnetnum given 255.255.0.0, got 255.255.0.0
restrict: op 1 addr 10.0.0.0 mask 255.255.0.0 mflags 00000000 flags 00000000 getnetnum given 127.0.0.1, got 127.0.0.1
restrict: op 1 addr 127.0.0.1 mask 255.255.255.255 mflags 00000000 flags 00000000
2025-12-29T11:25:21 ntpd[3218]: CONFIG: restrict notrap ignored
restrict source template mflags 4000 flags c0
restrict: op 1 addr (null) mask (null) mflags 00004000 flags 000000c0 loop_config: item 12 freq -4.302048
2025-12-29T11:25:21 ntpd[3218]: CLOCK: leapsecond file ('/usr/share/zoneinfo/leap-seconds.list'): good hash signature 2025-12-29T11:25:21 ntpd[3218]: CLOCK: leapsecond file ('/usr/share/zoneinfo/leap-seconds.list'): loaded,
expire=2026-06-28T00:00Z last=2017-01-01T00:00Z ofs=37
event at 0 0.0.0.0 c01e 0e TAI 37 leap 2017-01-01T00:00Z expires 2026-06-28T00:00Z
create_sockets(123)
move_fd: estimated max descriptors: 1024, initial socket boundary: 16 2025-12-29T11:25:21 ntpd[3218]: INIT: Using SO_TIMESTAMPNS(ns) 2025-12-29T11:25:21 ntpd[3218]: IO: Listen and drop on 0 v4wildcard 0.0.0.0:123
created interface #0: fd=16, name=v4wildcard, flags=0x89, ifindex=0, sin=0.0.0.0, bcast=0.0.0.0, mask=255.255.255.255, Disabled: create_interface(127.0.0.1#123)
2025-12-29T11:25:21 ntpd[3218]: IO: Listen normally on 1 lo 127.0.0.1:123 restrict: op 1 addr 127.0.0.1 mask 255.255.255.255 mflags 00003000 flags 00000001
created interface #1: fd=17, name=lo, flags=0x5, ifindex=1,
sin=127.0.0.1, mask=255.0.0.0, Enabled:
create_interface(10.0.0.200#123)
2025-12-29T11:25:21 ntpd[3218]: IO: Listen normally on 2 eth0 10.0.0.200:123 restrict: op 1 addr 10.0.0.200 mask 255.255.255.255 mflags 00003000
flags 00000001
created interface #2: fd=18, name=eth0, flags=0x9, ifindex=2,
sin=10.0.0.200, bcast=10.0.255.255, mask=255.255.0.0, Enabled:
create_sockets: Total interfaces = 3
2025-12-29T11:25:21 ntpd[3218]: IO: Listening on routing socket on fd
#19 for interface updates
findexistingpeer_addr(10.0.0.1:123, NULL, 3)
peer_clear: at 0 next 1 associd 17767 refid INIT
event at 0 10.0.0.1 8011 81 mobilize assoc 17767
newpeer: 10.0.0.200->10.0.0.1 mode 3 vers 4 poll 4 4 flags 0x1 0x1 mode
0 key 00000000
findexistingpeer_addr(10.0.0.141:123, NULL, 3)
peer_clear: at 0 next 2 associd 17768 refid INIT
event at 0 10.0.0.141 8011 81 mobilize assoc 17768
newpeer: 10.0.0.200->10.0.0.141 mode 3 vers 4 poll 4 4 flags 0x1 0x1
mode 0 key 00000000
2025-12-29T11:25:21 ntpd[3218]: INIT: MRU 13107 entries, 13 hash bits,
32768 bytes
loop_config: item 1 freq 0.000000
kernel loop status 0x41 (Clock Unsynchronized)
2025-12-29T11:25:21 ntpd[3218]: CLOCK: kernel reports TIME_ERROR: 0x41:
Clock Unsynchronized
event at 0 0.0.0.0 c01d 0d kern kernel time sync enabled
kernel loop status 0x41 (Clock Unsynchronized)
2025-12-29T11:25:21 ntpd[3218]: CLOCK: kernel reports TIME_ERROR: 0x41:
Clock Unsynchronized
event at 0 0.0.0.0 c012 02 freq_set kernel -4.302048 PPM
local_clock: mu 0 state 2 poll 0 count 0
event at 0 0.0.0.0 c016 06 restart
2025-12-29T11:25:21 ntpd[3218]: INIT: Built with OpenSSL 3.5.0 8 Apr
2025, 30500000
2025-12-29T11:25:21 ntpd[3218]: INIT: Running with OpenSSL 3.5.1 1 Jul
2025, 30500010
2025-12-29T11:25:21 ntpd[3218]: NTSc: Using system default root
certificates.
select() returned -1: Interrupted system call
sendpkt(18, dst=10.0.0.1, src=10.0.0.200, len=48)
transmit: at 1 10.0.0.200->10.0.0.1 mode 3 keyid 00000000 len 48
poll_update: at 1 10.0.0.1 poll 4 burst 0 retry 0 head 14 early 2 next 16 timer: interface update
2025-12-29T11:25:23 ntpd[3218]: ERR: fetch_timestamp: strange control
message 0x23
event at 1 0.0.0.0 c01d 0d kern kernel time sync disabled

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

On 29/12/2025 19:33, A C wrote:

I have been updating many of my computers to Debian Trixie which uses
ntpd 1.2.3 (as ntpsec)

I'm not aware of any follower of this newsgroup/mailing list who is
involved with the ntpsec project. Contact information for that project
can be found at <https://ntpsec.org/channels.html>.

Does the standard ntpd implementation work?

If you feel it appropriate to continue here, please get the subject
altered to reflect that you are referring to the code from the NTPSec
project.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

On 2025-12-29 15:37, David Woolley wrote:

On 29/12/2025 19:33, A C wrote:

I have been updating many of my computers to Debian Trixie which uses
ntpd 1.2.3 (as ntpsec)

I'm not aware of any follower of this newsgroup/mailing list who is
involved with the ntpsec project.-a Contact information for that project
can be found at <https://ntpsec.org/channels.html>.

Does the standard ntpd implementation work?

If you feel it appropriate to continue here, please get the subject
altered to reflect that you are referring to the code from the NTPSec project.

Apologies, yes it's the ntpsec version. My next step was to try to
compile regular NTP to be sure. But thank you for the contact info.

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp


On 12/29/25 8:36 PM, A C wrote:

On 2025-12-29 15:37, David Woolley wrote:

On 29/12/2025 19:33, A C wrote:

I have been updating many of my computers to Debian Trixie which
uses ntpd 1.2.3 (as ntpsec)

I'm not aware of any follower of this newsgroup/mailing list who is
involved with the ntpsec project.-a Contact information for that
project can be found at <https://ntpsec.org/channels.html>.

Does the standard ntpd implementation work?

If you feel it appropriate to continue here, please get the subject
altered to reflect that you are referring to the code from the NTPSec
project.

Apologies, yes it's the ntpsec version. My next step was to try to
compile regular NTP to be sure. But thank you for the contact info.

Using only 2 time servers is the worst configuration you can have.


--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

On 2025-12-29 18:13, Danny Mayer (via questions Mailing List) wrote:

On 12/29/25 8:36 PM, A C wrote:

On 2025-12-29 15:37, David Woolley wrote:

On 29/12/2025 19:33, A C wrote:

I have been updating many of my computers to Debian Trixie which
uses ntpd 1.2.3 (as ntpsec)

I'm not aware of any follower of this newsgroup/mailing list who is
involved with the ntpsec project.-a Contact information for that
project can be found at <https://ntpsec.org/channels.html>.

Does the standard ntpd implementation work?

If you feel it appropriate to continue here, please get the subject
altered to reflect that you are referring to the code from the NTPSec
project.

Apologies, yes it's the ntpsec version. My next step was to try to
compile regular NTP to be sure. But thank you for the contact info.

Using only 2 time servers is the worst configuration you can have.

It's only two for testing but not a major concern because the two are my
own servers on the same subnet that have many sources. One of them is
the primary router which has a couple dozen sources available and is
there to bootstrap the network. Afterwards the second server has a GPS receiver and PPS attached and ends up being the primary source of time
for the network.

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

On 30/12/2025 08:53, A C wrote:

It's only two for testing but not a major concern because the two are my
own servers on the same subnet that have many sources.-a One of them is
the primary router which has a couple dozen sources available and is
there to bootstrap the network. Afterwards the second server has a GPS receiver and PPS attached and ends up being the primary source of time
for the network.

I believe with only two, the calculated error bounds of both of them
have to overlap, or they will both be rejected.

Also, whilst there is a figure head source, the actual time solution
will be an aggregate of multiple sources, so "prime server" is probably overstating things.
--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

On 2025-12-30 08:49, David Woolley wrote:

On 30/12/2025 08:53, A C wrote:

It's only two for testing but not a major concern because the two are
my own servers on the same subnet that have many sources.-a One of them
is the primary router which has a couple dozen sources available and
is there to bootstrap the network. Afterwards the second server has a
GPS receiver and PPS attached and ends up being the primary source of
time for the network.

I believe with only two, the calculated error bounds of both of them
have to overlap, or they will both be rejected.

Also, whilst there is a figure head source, the actual time solution
will be an aggregate of multiple sources, so "prime server" is probably overstating things.

I override the selection algorithm by marking the GPS source preferred.
If the network comes up from a black start (e.g. a complete, extended
power failure that causes everything to shut down) the gateway is the
first machine to come back up. It has an RTC but it will still get the
primary external connection up and running then update its time. The
rest of the machines come up afterwards so they'll all start querying
the gateway until the GPS server comes back online. At that point it
starts responding to time requests and all the machines switch over to
the GPS source.

I haven't had any problems with the setup in the many years I've been
running it.

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

--0000000000004d1af70647398ebb
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Dec 29, 2025 at 7:31=E2=80=AFPM A C <agcarver+ntp@acarver.net> wrot=
e:

I have been updating many of my computers to Debian Trixie which uses
ntpd 1.2.3 (as ntpsec)

[...]

Attempting to start ntpd fails so I've run a debug output. I am able to
use ntpdate to set the clock on this machine but I can't start ntpd. Any
help understanding what might be happening would be appreciated.

# ntpd -d -d -g -n
[...]

poll_update: at 1 10.0.0.1 poll 4 burst 0 retry 0 head 14 early 2 next 16

timer: interface update
2025-12-29T11:25:23 ntpd[3218]: ERR: fetch_timestamp: strange control
message 0x23
event at 1 0.0.0.0 c01d 0d kern kernel time sync disabled

I believe this is a known issue fixed in ntpsec 1.2.4:

https://gitlab.com/NTPsec/ntpsec/-/issues/842

I'd like to think this wouldn't happen with ntp.org's ntpd ("NTP Classic"
in the fork ntpsec's terminology). There's some serious voodoo going on in ntp_packetstamp.c in ntpsec, apparently to allow, for example, a 32-bit
ntpd to work with a 64-bit kernel. The code in the original ntpd requires
it to be built to match the kernel (e.g. 64-bit ntpd even on a 64-bit
kernel which supports 32-bit programs for binary compatibility.

Coincidentally I've been looking at this area of the original ntpd code to
fix a failure to use interrupt-time receive timestamps on FreeBSD IPv6 and
to add support for same to Windows ntpd.

Cheers,
Dave Hart

--0000000000004d1af70647398ebb
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div><div class=3D"gmail_default" style= =3D"font-family:&quot;trebuchet ms&quot;,sans-serif"></div></div></div><br>= <div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"= gmail_attr">On Mon, Dec 29, 2025 at 7:31=E2=80=AFPM A C &lt;<a href=3D"mail= to:agcarver%2Bntp@acarver.net">agcarver+ntp@acarver.net</a>&gt; wrote:<br><= /div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo= rder-left:1px solid rgb(204,204,204);padding-left:1ex">I have been updating=
many of my computers to Debian Trixie which uses <br>
ntpd 1.2.3 (as ntpsec)<br>

<span class=3D"gmail_default" style=3D"font-family:&quot;trebuchet ms&quot;= ,sans-serif">[...]</span><br>

Attempting to start ntpd fails so I&#39;ve run a debug output. I am able to=

use ntpdate to set the clock on this machine but I can&#39;t start ntpd. An=
y <br>
help understanding what might be happening would be appreciated.<br>


# ntpd -d -d -g -n<br>
<span class=3D"gmail_default" style=3D"font-family:&quot;trebuchet ms&quot;= ,sans-serif">[...]</span></blockquote><blockquote class=3D"gmail_quote" sty= le=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);paddi= ng-left:1ex">poll_update: at 1 10.0.0.1 poll 4 burst 0 retry 0 head 14 earl=
y 2 next 16<br>
timer: interface update<br><span style=3D"background-color:rgb(238,238,238)= "><font color=3D"#134f5c">
2025-12-29T11:25:23 ntpd[3218]: ERR: fetch_timestamp: strange control <br> message 0x23</font></span><br>
event at 1 0.0.0.0 c01d 0d kern kernel time sync disabled<br></blockquote><= div class=3D"gmail_default" style=3D"font-family:&quot;trebuchet ms&quot;,s= ans-serif"></div><div class=3D"gmail_default" style=3D"font-family:&quot;tr= ebuchet ms&quot;,sans-serif">I believe this is a known issue fixed in ntpse=
c 1.2.4:</div><div class=3D"gmail_default" style=3D"font-family:&quot;trebu= chet ms&quot;,sans-serif"><br></div><div class=3D"gmail_default" style=3D"f= ont-family:&quot;trebuchet ms&quot;,sans-serif"><a href=3D"https://gitlab.c= om/NTPsec/ntpsec/-/issues/842">https://gitlab.com/NTPsec/ntpsec/-/issues/84= 2</a></div><div class=3D"gmail_default" style=3D"font-family:&quot;trebuche=
t ms&quot;,sans-serif"><br></div><div class=3D"gmail_default" style=3D"font= -family:&quot;trebuchet ms&quot;,sans-serif">I&#39;d like to think this wou= ldn&#39;t happen with <a href=3D"http://ntp.org">ntp.org</a>&#39;s ntpd (&q= uot;NTP Classic&quot; in the fork ntpsec&#39;s terminology).=C2=A0 There&#3= 9;s some serious voodoo going on in ntp_packetstamp.c in ntpsec, apparently=
to allow, for example, a 32-bit ntpd to work with a 64-bit kernel.=C2=A0 T=
he code in the original ntpd requires it to be built to match the kernel (e= .g. 64-bit ntpd even on a 64-bit kernel which supports 32-bit programs for = binary compatibility.</div><div class=3D"gmail_default" style=3D"font-famil= y:&quot;trebuchet ms&quot;,sans-serif"><br></div><div class=3D"gmail_defaul=
t" style=3D"font-family:&quot;trebuchet ms&quot;,sans-serif">Coincidentally=
I&#39;ve been looking at this area of the original ntpd code to fix a fail= ure to use interrupt-time receive timestamps on FreeBSD IPv6 and to add sup= port for same to Windows ntpd.</div><div><br clear=3D"all"></div><div><div = dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div><span style=3D"= color:rgb(102,102,102);font-family:tahoma,sans-serif">Cheers,</span></div><= font face=3D"tahoma, sans-serif" color=3D"#666666">Dave Hart</font></div></= div></div><br class=3D"gmail-Apple-interchange-newline"></div></div>

--0000000000004d1af70647398ebb--

--- Synchronet 3.21a-Linux NewsLink 1.2

From Newsgroup: comp.protocols.time.ntp

On 2025-12-30, A C <agcarver+ntp@acarver.net> wrote:

On 2025-12-29 18:13, Danny Mayer (via questions Mailing List) wrote:

On 12/29/25 8:36 PM, A C wrote:

On 2025-12-29 15:37, David Woolley wrote:

On 29/12/2025 19:33, A C wrote:

I have been updating many of my computers to Debian Trixie which
uses ntpd 1.2.3 (as ntpsec)

I'm not aware of any follower of this newsgroup/mailing list who is
involved with the ntpsec project.-a Contact information for that
project can be found at <https://ntpsec.org/channels.html>.

Does the standard ntpd implementation work?

If you feel it appropriate to continue here, please get the subject
altered to reflect that you are referring to the code from the NTPSec >>>> project.

Apologies, yes it's the ntpsec version. My next step was to try to
compile regular NTP to be sure. But thank you for the contact info.

Using only 2 time servers is the worst configuration you can have.

It's only two for testing but not a major concern because the two are my
own servers on the same subnet that have many sources. One of them is
the primary router which has a couple dozen sources available and is
there to bootstrap the network. Afterwards the second server has a GPS receiver and PPS attached and ends up being the primary source of time
for the network.

The problem with two is that if one of them goes nuts (decides that the
date is Jun23 1976) then your system has no way of knowing that is
wrong, and of knowing which of the two sources is now good and which
bad.
Also you say that your gps server gives the time to the whole network.
Does it also give the time to your other server (with your many sources)
that tends reduce the sysem to only one source, the gps, because the
other systems all also get their time from that one source. Ie, you
want to make the sources as uncorrelated as possible.
--- Synchronet 3.21a-Linux NewsLink 1.2