# NTP Analyzer not working as expected

**URL:** <https://community.zeek.org/t/ntp-analyzer-not-working-as-expected/3961>\
**Category:** Zeek\
**Created:** [January 7, 2016, 1:17am UTC](https://community.zeek.org/t/ntp-analyzer-not-working-as-expected/3961 "2016-01-07T01:17:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert\_Young](https://avatars.discourse-cdn.com/v4/letter/r/6de8d8/32.png) [@Robert\_Young](https://community.zeek.org/u/Robert_Young)\
**Post date:** [January 7, 2016, 1:17am UTC](https://community.zeek.org/t/ntp-analyzer-not-working-as-expected/3961/1 "2016-01-07T01:17:40Z")

</div>

Hi Guys, I am trying to detect hosts that are ntp clients to verify they are not also acting as a server. I have setup the basic script as seen below using event ntp\_msg(). When I run the code I see the msg code for client(3) and server(4) as expected. But what does not look correct is the orig\_h is the same for both the request from the client and the response from the server. In this test the client is 172.16.1.7 and they server is 172.16.1. 41 Anyone have any ideas of what I may have missed ? or have I hit a bug ?

Regards,  
Robert

Debug output:

> ID:=, 1229867348  
> orig\_h=, 172.16.1.7  
> resp\_host=, 172.16.1.41  
> msg code=, 3  
> excess=,  
> ID:=, 2733850379  
> orig\_h=, 172.16.1.7  
> resp\_host=, 172.16.1.41  
> msg code=, 4  
> excess=,

 ![Inline image 1](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/99fbe664a747fb2b4370047b0c004b4d518029a6.png)

Code:

module NTP;

export {  
redef enum Log::ID += { LOG };

redef enum Notice::Type += {  
NTP\_ALARM,  
NTP\_Monlist\_Queries,  
};

type ntp\_record: record {  
ts: time &log;  
uid: string &log;  
orig: addr &log;  
resp: addr &log;  
refid: count &default=0 &log;  
code: count &default=0 &log;  
stratum: count &default=0 &log;  
poll: count &default=0 &log;  
precision: int &default=to\_int(“0”) &log;  
#distance: interval;  
#dispersion: interval;  
reftime: time &log;  
#orig: time;  
#rec: time;  
#xmt: time;  
excess: string &default=“NULL” &log;  
};

# The code value maps to the NTP mode type - for now I am mostly

# interested in control messages.

 ![image.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/99fbe664a747fb2b4370047b0c004b4d518029a6.png)

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [January 7, 2016, 4:04pm UTC](https://community.zeek.org/t/ntp-analyzer-not-working-as-expected/3961/2 "2016-01-07T16:04:32Z")

</div>

Bro “sessionizes” UDP traffic. What you are seeing is the result of that. The assumption is the first to speak is the originator of the “connection”.

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Young\_Robert\_ryoung1](https://avatars.discourse-cdn.com/v4/letter/y/ec9cab/32.png) [@Young\_Robert\_ryoung1](https://community.zeek.org/u/Young_Robert_ryoung1)\
**Post date:** [January 7, 2016, 8:55pm UTC](https://community.zeek.org/t/ntp-analyzer-not-working-as-expected/3961/3 "2016-01-07T20:55:02Z")

</div>

This was the response I received

Robert Young  
Senior Network Engineer/Team Lead, Terrestrial Network Engineering, Shared Services  
HARRIS CAPROCK  
Office: +1-832-668-2635 / Mobile: +1-281-701-9684

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/ntp-analyzer-not-working-as-expected/3961/4 "2022-05-06T15:43:19Z")

</div>