forcing ntpd to query from a restricted interface or subnet

Anton Melser

unread,

May 4, 2012, 11:04:24 AM5/4/12

to

Hi,
I am cross-posting this from the CentOS list - there have been plenty
of views but no answers and I'm not sure exactly where to post...
So I have CentOS 6 (x64) - apparently nptd "Ver. 4.2.4p8". My problem
is that I have too many IPs for ntpd to do a listen on every one. So I
tried restricting both with adding -I eth0 on the command line
parameters (in /etc/sysconf/ntpd) and with the interface instruction
in /etc/ntp.conf. Neither works, and ntpd refuses to start.

...
May 3 09:40:57 MyHost ntpd[980]: Listening on interface #1005
eth1:132235, 10.132.235.1#123 Enabled
May 3 09:40:57 MyHost ntpd[980]: Listening on interface #1006
eth1:132236, 10.132.236.1#123 Enabled
May 3 09:40:57 MyHost ntpd[980]: Listening on interface #1007
eth1:132237, 10.132.237.1#123 Enabled
May 3 09:40:57 MyHost ntpd[980]: Too many sockets in use, FD_SETSIZE
1024 exceeded

Sorry if this is the wrong place to post (if so please point in the
right direction).
Cheers
Anton

--
echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D4D465452snlbxq' | dc
This will help you for 99.9% of your problems ...
-> not this one! :-)

Dave Hart

unread,

May 6, 2012, 3:49:12 PM5/6/12

to

On Fri, May 4, 2012 at 3:04 PM, Anton Melser <melser...@gmail.com> wrote:
> Hi,
> I am cross-posting this from the CentOS list - there have been plenty
> of views but no answers and I'm not sure exactly where to post...
> So I have CentOS 6 (x64) - apparently nptd "Ver. 4.2.4p8". My problem
> is that I have too many IPs for ntpd to do a listen on every one. So I
> tried restricting both with adding -I eth0 on the command line
> parameters (in /etc/sysconf/ntpd) and with the interface instruction
> in /etc/ntp.conf. Neither works, and ntpd refuses to start.
>
> ...
> May 3 09:40:57 MyHost ntpd[980]: Listening on interface #1005
> eth1:132235, 10.132.235.1#123 Enabled
> May 3 09:40:57 MyHost ntpd[980]: Listening on interface #1006
> eth1:132236, 10.132.236.1#123 Enabled
> May 3 09:40:57 MyHost ntpd[980]: Listening on interface #1007
> eth1:132237, 10.132.237.1#123 Enabled
> May 3 09:40:57 MyHost ntpd[980]: Too many sockets in use, FD_SETSIZE
> 1024 exceeded

This is fixed in newer versions, I suggest you try 4.2.6p5 or ntp-dev.
Support for truly restricting listening interfaces with "interface"
(AKA "nic") in ntp.conf was introduced late in the 4.2.5 cycle.
Something like the following should work for you:

interface ignore all
interface listen eth0

That should result in ntpd using only v4/v6 localhost and eth0's v4/v6
addresses.

Cheers,
Dave Hart

Harlan Stenn

unread,

May 6, 2012, 3:53:55 PM5/6/12

to

Anton,

> I am cross-posting this from the CentOS list - there have been plenty
> of views but no answers and I'm not sure exactly where to post...
> So I have CentOS 6 (x64) - apparently nptd "Ver. 4.2.4p8".

4.2.4 is Old - it was released in 2006 and became unsupported in 2009.

> My problem is that I have too many IPs for ntpd to do a listen on
> every one. So I tried restricting both with adding -I eth0 on the
> command line parameters (in /etc/sysconf/ntpd) and with the interface
> instruction in /etc/ntp.conf. Neither works, and ntpd refuses to
> start.

You want to use ntp-stable, 4.2.6, at least. 4.2.7 has been stable for
a while - we're waiting on some documentation system updates before we
release it as 4.2.8.

H

Harlan Stenn

unread,

May 6, 2012, 4:09:55 PM5/6/12

to

> > (AKA "nic") in ntp.conf was introduced late in the 4.2.5 cycle.
> > Something like the following should work for you:
> >
> > interface ignore all
> > interface listen eth0
> >
> > That should result in ntpd using only v4/v6 localhost and eth0's v4/v6
> > addresses.
>

> Thanks for that. I found a 4.2.6 built for Fedora 14 which did the
> trick. All I needed was -L in the end (it's not like I have 1k
> physical interfaces!). Definitely a shame that no one wants to
> maintain packages for RHEL6/CentOS6 for this. (I know, I know, if only
> I had more time...)

-L is mostly only useful under Linux, and the "interface" stuff works
all over.

You might not "appreciate" the numbering system NTP uses. Going from
4.2.4 to 4.2.6 is a significant upgrade - the current NTP numbering
scheme uses ProtocolVersion.MajorVersion.MinorVersion[-pPointLevel].

Many other packages use Major.Minor.Point, and if that is what you are
expecting you would easily think there isn't a significant change
between 4.2.4 and 4.2.6.

To get a better idea of the changes involved, please look at the
ChangeLog file for 4.2.6 and see what has been done between 2006 and
"now".

H