# NTP packets outbound but no NTP service installed

## Kvetch

I have a small network tap splitting my comcast cable modem connection and snort listening on the other end of the tap.  I recently re-installed Gentoo on my machine and just finished getting tcpdump and snort installed.  The other day I noticed I started seeing ntp v1 packets going out.  I don't have ntpd installed nor ntpclient.  I'm not sure what it could be that is sending the traffic out.  Netstat shows that the only tcp/udp port open on my machine is tcp 22 and I am confident I don't have any other services runnning that need to bind to a port.

Below is what I am seeing, my machine making a connection to clock.via.net once an hour

02:18:48.695616 IP (tos 0x0, ttl  64, id 2654, offset 0, flags [none], length: 76) 24.111.222.12.2344 > 209.81.9.7.123: [udp sum ok] NTPv1 client, strat 0, poll 0, prec 0 dist 0.000000, disp 0.000000, ref (unspec)@0.000000000 orig 0.000000000 rec 0.000000000 xmt 0.000000000

03:18:48.880079 IP (tos 0x0, ttl  64, id 3316, offset 0, flags [none], length: 76) 24.111.222.12.2675 > 209.81.9.7.123: [udp sum ok] NTPv1 client, strat 0, poll 0, prec 0 dist 0.000000, disp 0.000000, ref (unspec)@0.000000000 orig 0.000000000 rec 0.000000000 xmt 0.000000000

04:18:49.064481 IP (tos 0x0, ttl  64, id 3978, offset 0, flags [none], length: 76) 24.111.222.12.3006 > 209.81.9.7.123: [udp sum ok] NTPv1 client, strat 0, poll 0, prec 0 dist 0.000000, disp 0.000000, ref (unspec)@0.000000000 orig 0.000000000 rec 0.000000000 xmt 0.000000000

05:18:49.248976 IP (tos 0x0, ttl  64, id 4640, offset 0, flags [none], length: 76) 24.111.222.12.3337 > 209.81.9.7.123: [udp sum ok] NTPv1 client, strat 0, poll 0, prec 0 dist 0.000000, disp 0.000000, ref (unspec)@0.000000000 orig 0.000000000 rec 0.000000000 xmt 0.000000000

Here is my world file

net-analyzer/bing

net-analyzer/darkstat

x11-proto/dmxproto

media-sound/alsa-utils

net-analyzer/tcptraceroute

app-emulation/emul-linux-x86-gtklibs

x11-themes/gtk-engines

sys-fs/lvm2

app-emulation/emul-linux-x86-qtlibs

x11-misc/beryl-settings

sys-apps/tcp-wrappers

net-analyzer/ngrep

app-emulation/vmware-server

net-analyzer/ntop

app-arch/unzip

x11-drivers/xf86-input-evdev

net-analyzer/authforce

sys-apps/hal

x11-libs/libdmx

net-analyzer/traceroute

net-analyzer/smokeping

net-analyzer/cryptcat

app-portage/gentoolkit

app-emulation/emul-linux-x86-compat

kde-base/kde-meta

app-editors/vim

net-dns/bind-tools

sys-process/vixie-cron

net-analyzer/nikto

x11-wm/beryl-core

net-analyzer/hping

media-gfx/gimp

x11-libs/libwnck

sys-boot/grub

net-analyzer/ssldump

x11-plugins/beryl-plugins

net-analyzer/bing

net-analyzer/bing

net-analyzer/packit

net-analyzer/fping

media-sound/amarok

x11-base/xorg-x11

net-misc/netkit-telnetd

net-analyzer/wireshark

net-analyzer/arpwatch

net-analyzer/p0f

net-analyzer/nmap

net-analyzer/snort

net-analyzer/arping

app-cdr/k3b

net-analyzer/trafshow

net-analyzer/httping

net-analyzer/nmbscan

sys-kernel/gentoo-sources

net-analyzer/snortalog

net-analyzer/scapy

net-misc/dhcpcd

sys-apps/hotplug

net-analyzer/snortsam

x11-plugins/beryl-dbus

net-analyzer/poink

app-emulation/emul-linux-x86-baselibs

x11-apps/xdpyinfo

media-gfx/imagemagick

x11-drivers/nvidia-drivers

net-analyzer/rrdtool

app-emulation/emul-linux-x86-xlibs

x11-misc/beryl-manager

sys-apps/dbus

x11-wm/beryl

net-analyzer/xprobe

net-analyzer/arpoison

app-admin/metalog

net-analyzer/macchanger

net-analyzer/tcpdump

net-analyzer/ifstat

Does anybody have any clues as to what on my machine would try to sync?

Thanks,

Nick

----------

## gerdesj

In KDE, right click your clock and select "Adjust Date and Time".  Is it using NTP - set Date/Time automatically?

Cheers

Jon

----------

## Kvetch

Thanks for replying, no it is not.  I don't have that option in my KDE 3.5.5 clock config.

----------

