I am working on an NTP Client. A few other threads indicate that the a message containing \"\\x1b\' + 47 * \'\\0\" is sent to the NTP server, but none of these threads give
"\x1b' + 47 * '\0"
represents a data field of 48 bytes. 0x1B
followed by 47 times
0
. 48 bytes is the size of an NTP UDP packet. The first byte (0x1B) specifies LI
, VN
, and Mode
.
RFC 5905 NTP Specification (7.3. Packet Header Variables) specifies the message header as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|LI | VN |Mode | Stratum | Poll | Precision |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Setting the first byte of the data to 0x1B
or 00 011 011
means
LI = 0 (Leap indicator)
VN = 3 (Version number)
Mode = 3 (Mode, mode 3 is client mode)
You may also use the more recent version (VN = 4
). This would require the first header byte to be set to
0x23 (00 100 011)
.
The modes are defined as
+-------+--------------------------+
| Value | Meaning |
+-------+--------------------------+
| 0 | reserved |
| 1 | symmetric active |
| 2 | symmetric passive |
| 3 | client |
| 4 | server |
| 5 | broadcast |
| 6 | NTP control message |
| 7 | reserved for private use |
+-------+--------------------------+
Specifying Mode = 3
indicates the message as a client request message.
Sending such a packet to port 123 of an NTP server will force the server to send a reply package.