Hi Guys, I am trying to detect hosts that are ntp clients to verify they are not also acting as a server. I have setup the basic script as seen below using event ntp_msg(). When I run the code I see the msg code for client(3) and server(4) as expected. But what does not look correct is the orig_h is the same for both the request from the client and the response from the server. In this test the client is 172.16.1.7 and they server is 172.16.1. 41 Anyone have any ideas of what I may have missed ? or have I hit a bug ?
Regards,
Robert
Debug output:
ID:=, 1229867348
orig_h=, 172.16.1.7
resp_host=, 172.16.1.41
msg code=, 3
excess=,
ID:=, 2733850379
orig_h=, 172.16.1.7
resp_host=, 172.16.1.41
msg code=, 4
excess=,
Code:
module NTP;
export {
redef enum Log::ID += { LOG };
redef enum Notice::Type += {
NTP_ALARM,
NTP_Monlist_Queries,
};
type ntp_record: record {
ts: time &log;
uid: string &log;
orig: addr &log;
resp: addr &log;
refid: count &default=0 &log;
code: count &default=0 &log;
stratum: count &default=0 &log;
poll: count &default=0 &log;
precision: int &default=to_int(“0”) &log;
#distance: interval;
#dispersion: interval;
reftime: time &log;
#orig: time;
#rec: time;
#xmt: time;
excess: string &default=“NULL” &log;
};