main.zeek

NTP

Namespace:: NTP

Summary

Redefinable Options

NTP::ports: set &redef

Well-known ports for NTP.

Types

`NTP::ControlInfo`: `record`	The record type which contains the column fields of the NTP control log.
`NTP::Info`: `record`
`NTP::PrivateInfo`: `record`	The record type which contains the column fields of the NTP private log.

Redefinitions

`Log::ID`: `enum`	`NTP::CONTROL_LOG` `NTP::LOG` `NTP::PRIVATE_LOG`
`connection`: `record`	New Fields: `connection` ntp: `NTP::Info` `&optional` ntp_control: `NTP::ControlInfo` `&optional` ntp_private: `NTP::PrivateInfo` `&optional`

Events

`NTP::log_ntp`: `event`	Event that can be handled to access the NTP record as it is sent on to the logging framework.
`NTP::log_ntp_control`: `event`	Event that can be handled to access the NTP control record.
`NTP::log_ntp_private`: `event`	Event that can be handled to access the NTP private record.

Hooks

`NTP::log_policy`: `Log::PolicyHook`
`NTP::log_policy_control`: `Log::PolicyHook`
`NTP::log_policy_private`: `Log::PolicyHook`

Detailed Interface

Redefinable Options

NTP::ports 

Type:

set [port]

Attributes:

&redef

Default:

{
   123/udp
}

Well-known ports for NTP.

Types

NTP::ControlInfo 

Type:

record

Fields:

ts: time &log: Timestamp for when the event happened.

uid: string &log: Unique ID for the connection.

id: conn_id &log: The connection’s 4-tuple of endpoint addresses/ports.

version: count &log: The NTP version number (1, 2, 3, 4).

mode: count &log: The NTP mode being used.

op_code: count &log: The control operation code.

sequence: count &log: The sequence number of the control message.

status: count &log: The status word of the control response.

association_id: count &log: The association ID.

resp_bit: bool &log: The response bit. Set to zero for commands, one for responses.

err_bit: bool &log: The error bit. Set to zero for normal response, one for error.

more_bit: bool &log: The more bit. Set to zero for last fragment, one for all others.

data: string &log &optional: The payload data of the control message.

key_id: count &log &optional: The key ID used to generate the message-authentication code.

crypto_checksum: string &log &optional: The crypto-checksum computed by the encryption procedure.

The record type which contains the column fields of the NTP control log. For more in-depth documentation, see NTP::ControlMessage.

NTP::Info 

Type:

record

Fields:

ts: time &log: Timestamp for when the event happened.

uid: string &log: Unique ID for the connection.

id: conn_id &log: The connection’s 4-tuple of endpoint addresses/ports.

version: count &log: The NTP version number (1, 2, 3, 4).

mode: count &log: The NTP mode being used.

stratum: count &log: The stratum (primary server, secondary server, etc.).

poll: interval &log: The maximum interval between successive messages.

precision: interval &log: The precision of the system clock.

root_delay: interval &log: Total round-trip delay to the reference clock.

root_disp: interval &log: Total dispersion to the reference clock.

ref_id: string &log: For stratum 0, 4 character string used for debugging. For stratum 1, ID assigned to the reference clock by IANA. Above stratum 1, when using IPv4, the IP address of the reference clock. Note that the NTP protocol did not originally specify a large enough field to represent IPv6 addresses, so they use the first four bytes of the MD5 hash of the reference clock’s IPv6 address (i.e. an IPv4 address here is not necessarily IPv4).

ref_time: time &log: Time when the system clock was last set or correct.

org_time: time &log: Time at the client when the request departed for the NTP server.

rec_time: time &log: Time at the server when the request arrived from the NTP client.

xmt_time: time &log: Time at the server when the response departed for the NTP client.

num_exts: count &default = 0 &optional &log: Number of extension fields (which are not currently parsed).

NTP::PrivateInfo 

Type:

record

Fields:

ts: time &log: Timestamp for when the event happened.

uid: string &log: Unique ID for the connection.

id: conn_id &log: The connection’s 4-tuple of endpoint addresses/ports.

version: count &log: The NTP version number (1, 2, 3, 4).

mode: count &log: The NTP mode being used.

req_code: count &log: The request code.

sequence: count &log: The sequence number of the private message.

implementation: count &log: The implementation number.

auth_bit: bool &log: The authenticated bit. If set, this packet is authenticated.

err: count &log: The error code.

data: string &log &optional: The payload data of the private message.

The record type which contains the column fields of the NTP private log. For more in-depth documentation, see NTP::Mode7Message.

Events

NTP::log_ntp 

Type:: event (rec: NTP::Info)

Event that can be handled to access the NTP record as it is sent on to the logging framework.

NTP::log_ntp_control 

Type:: event (rec: NTP::ControlInfo)

Event that can be handled to access the NTP control record.

NTP::log_ntp_private 

Type:: event (rec: NTP::PrivateInfo)

Event that can be handled to access the NTP private record.

Hooks

NTP::log_policy 

Type:: Log::PolicyHook

NTP::log_policy_control 

Type:: Log::PolicyHook

NTP::log_policy_private 

Type:: Log::PolicyHook