Generated for all NTP messages. Different from many other of Bro’s events, this one is generated for both client-side and server-side messages.
See Wikipedia for more information about the NTP protocol.
U: The connection record describing the corresponding UDP flow. Msg: The parsed NTP message. Excess: The raw bytes of any optional parts of the NTP packet. Bro does not further parse any optional fields.
Bro’s current default configuration does not activate the protocol analyzer that generates this event; the corresponding script has not yet been ported to Bro 2.x. To still enable this event, one needs to register a port for it or add a DPD payload signature.