This document describes the use of the NTP Project's ntpdc
program,
that can be used to query a Network Time Protocol (NTP) server and
display the time offset of the system clock relative to the server
clock. Run as root, it can correct the system clock to this offset as
well. It can be run as an interactive command or from a cron job.
This document applies to version 4.2.7p303 of ntpdc
.
The program implements the SNTP protocol as defined by RFC 5905, the NTPv4 IETF specification.
By default, ntpdc
writes the local data and time (i.e., not UTC) to the
standard output in the format:
1996-10-15 20:17:25.123 (+0800) +4.567 +/- 0.089 secs
where YYYY-MM-DD HH:MM:SS.SUBSEC is the local date and time, (+0800) is the local timezone adjustment (so we would add 8 hours and 0 minutes to convert the reported local time to UTC), and the +4.567 +/- 0.089 secs indicates the time offset and error bound of the system clock relative to the server clock.
ntpdc
is a utility program used to query
ntpd(8)
about its
current state and to request changes in that state.
It uses NTP mode 7 control message formats described in the source code.
The program may
be run either in interactive mode or controlled using command line
arguments.
Extensive state and statistics information is available
through the
ntpdc
interface.
In addition, nearly all the
configuration options which can be specified at startup using
ntpd's configuration file may also be specified at run time using
ntpdc
.
This section was generated by AutoGen,
using the agtexi-cmd
template and the option descriptions for the ntpdc
program.
This software is released under the NTP license, <http://ntp.org/license>.
This is the automatically generated usage text for ntpdc.
The text printed is the same whether selected with the help
option
(--help) or the more-help
option (--more-help). more-help
will print
the usage text by passing it through a pager program.
more-help
is disabled on platforms without a working
fork(2)
function. The PAGER
environment variable is
used to select the program, defaulting to more. Both will exit
with a status code of 0.
ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p303 USAGE: ntpdc [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [ host ...] Flg Arg Option-Name Description -4 no ipv4 Force IPv4 DNS name resolution - prohibits these options: ipv6 -6 no ipv6 Force IPv6 DNS name resolution - prohibits these options: ipv4 -c Str command run a command and exit - may appear multiple times -d no debug-level Increase debug verbosity level - may appear multiple times -D Str set-debug-level Set the debug verbosity level - may appear multiple times -i no interactive Force ntpq to operate in interactive mode - prohibits these options: command listpeers peers showpeers -l no listpeers Print a list of the peers - prohibits these options: command -n no numeric numeric host addresses -p no peers Print a list of the peers - prohibits these options: command -s no showpeers Show a list of the peers - prohibits these options: command opt version Output version information and exit -? no help Display extended usage information and exit -! no more-help Extended usage information passed thru pager -> opt save-opts Save the option state to a config file -< Str load-opts Load options from a config file - disabled as --no-load-opts - may appear multiple times Options are specified by doubled hyphens and their name or by a single hyphen and the flag character. The following option preset mechanisms are supported: - reading file $HOME/.ntprc - reading file ./.ntprc - examining environment variables named NTPDC_* please send bug reports to: http://bugs.ntp.org, bugs@ntp.org
This is the “force ipv4 dns name resolution” option.
This option has some usage constraints. It:
Force DNS resolution of following host names on the command line to the IPv4 namespace.
This is the “force ipv6 dns name resolution” option.
This option has some usage constraints. It:
Force DNS resolution of following host names on the command line to the IPv6 namespace.
This is the “run a command and exit” option. This option takes an argument string cmd.
This option has some usage constraints. It:
The following argument is interpreted as an interactive format command and is added to the list of commands to be executed on the specified host(s).
This is the “force ntpq to operate in interactive mode” option.
This option has some usage constraints. It:
Force ntpq to operate in interactive mode. Prompts will be written to the standard output and commands read from the standard input.
This is the “print a list of the peers” option.
This option has some usage constraints. It:
Print a list of the peers known to the server as well as a summary of their state. This is equivalent to the 'listpeers' interactive command.
This is the “numeric host addresses” option. Output all host addresses in dotted-quad numeric format rather than converting to the canonical host names.
This is the “print a list of the peers” option.
This option has some usage constraints. It:
Print a list of the peers known to the server as well as a summary of their state. This is equivalent to the 'peers' interactive command.
This is the “show a list of the peers” option.
This option has some usage constraints. It:
Print a list of the peers known to the server as well as a summary of their state. This is equivalent to the 'dmpeers' interactive command.
Any option that is not marked as not presettable may be preset by
loading values from configuration ("rc" or "ini") files, and values from environment variables named NTPDC
and NTPDC_<OPTION_NAME>
. <OPTION_NAME>
must be one of
the options listed above in upper case and segmented with underscores.
The NTPDC
variable will be tokenized and parsed like
the command line. The remaining variables are tested for existence and their
values are treated like option arguments.
libopts
will search in 2 places for configuration files:
HOME
, and PWD
are expanded and replaced when ntpdc runs.
For any of these that are plain files, they are simply processed.
For any that are directories, then a file named .ntprc is searched for
within that directory and processed.
Configuration files may be in a wide variety of formats. The basic format is an option name followed by a value (argument) on the same line. Values may be separated from the option name with a colon, equal sign or simply white space. Values may be continued across multiple lines by escaping the newline with a backslash.
Multiple programs may also share the same initialization file. Common options are collected at the top, followed by program specific segments. The segments are separated by lines like:
[NTPDC]
or by
<?program ntpdc>
Do not mix these styles within one configuration file.
Compound values and carefully constructed string values may also be specified using XML syntax:
<option-name> <sub-opt>...<...>...</sub-opt> </option-name>
yielding an option-name.sub-opt
string value of
"...<...>..."
AutoOpts
does not track suboptions. You simply note that it is a
hierarchicly valued option. AutoOpts
does provide a means for searching
the associated name/value pair list (see: optionFindValue).
The command line options relating to configuration and/or usage help are:
Print the program version to standard out, optionally with licensing information, then exit 0. The optional argument specifies how much licensing detail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. Only the first letter of the argument is examined:
One of the following exit values will be returned:
If one or more request options are included on the command line
when
ntpdc
is executed, each of the requests will be sent
to the NTP servers running on each of the hosts given as command
line arguments, or on localhost by default.
If no request options
are given,
ntpdc
will attempt to read commands from the
standard input and execute these on the NTP server running on the
first host given on the command line, again defaulting to localhost
when no other host is specified.
The
ntpdc
utility will prompt for
commands if the standard input is a terminal device.
The
ntpdc
utility uses NTP mode 7 packets to communicate with the
NTP server, and hence can be used to query any compatible server on
the network which permits it.
Note that since NTP is a UDP protocol
this communication will be somewhat unreliable, especially over
large distances in terms of network topology.
The
ntpdc
utility makes
no attempt to retransmit requests, and will time requests out if
the remote host is not heard from within a suitable timeout
time.
The operation of
ntpdc
are specific to the particular
implementation of the
ntpd(8)
daemon and can be expected to
work only with this and maybe some previous versions of the daemon.
Requests from a remote
ntpdc
utility which affect the
state of the local server must be authenticated, which requires
both the remote program and local server share a common key and key
identifier.
Note that in contexts where a host name is expected, a
-4
qualifier preceding the host name forces DNS resolution to the IPv4 namespace,
while a
-6
qualifier forces DNS resolution to the IPv6 namespace.
Specifying a command line option other than
-i
or
-n
will cause the specified query (queries) to be sent to
the indicated host(s) immediately.
Otherwise,
ntpdc
will
attempt to read interactive format commands from the standard
input.
.Ss
"Interactive
Commands"
Interactive format commands consist of a keyword followed by zero
to four arguments.
Only enough characters of the full keyword to
uniquely identify the command need be typed.
The output of a
command is normally sent to the standard output, but optionally the
output of individual commands may be sent to a file by appending a
.Ql
\&>
,
followed by a file name, to the command line.
A number of interactive format commands are executed entirely
within the
ntpdc
utility itself and do not result in NTP
mode 7 requests being sent to a server.
These are described
following.
ntpdc
.
A
.Sq
Ic
\&?
followed by a command keyword will print function and usage
information about the command.
This command is probably a better
source of information about
ntpq(8)
than this manual
page.
-n
switch.
ntpdc
.
ntpdc
retries each query once after a timeout, the total waiting time for
a timeout will be twice the timeout value set.
.Ss "Control Message Commands" Query commands result in NTP mode 7 packets containing requests for information being sent to the server. These are read-only commands in that they make no modification of the server configuration state.
The character in the left margin indicates the mode this peer entry is operating in. A .Ql \&+ denotes symmetric active, a .Ql \&- indicates symmetric passive, a .Ql \&= means the remote server is being polled in client mode, a .Ql \&^ indicates that the server is broadcasting to this address, a .Ql \&~ denotes that the remote peer is sending broadcasts and a .Ql \&~ denotes that the remote peer is sending broadcasts and a .Ql \&* marks the peer the server is currently synchronizing to.
The contents of the host field may be one of four forms.
It may
be a host name, an IP address, a reference clock implementation
name with its parameter or
.Fn
REFCLK
"implementation_number"
"parameter"
.
On
.Ic
hostnames
.Cm
no
only IP-addresses
will be displayed.
The
.Sq
system
flags
show various system flags, some of
which can be set and cleared by the
.Ic
enable
and
.Ic
disable
configuration commands, respectively.
These are
the
.Cm
auth
,
.Cm
bclient
,
.Cm
monitor
,
.Cm
pll
,
.Cm
pps
and
.Cm
stats
flags.
See the
ntpd(8)
documentation for the meaning of these flags.
There
are two additional flags which are read only, the
.Cm
kernel_pll
and
.Cm
kernel_pps
.
These flags indicate
the synchronization status when the precision time kernel
modifications are in use.
The
.Sq
kernel_pll
indicates that
the local clock is being disciplined by the kernel, while the
.Sq
kernel_pps
indicates the kernel discipline is provided by the PPS
signal.
The .Sq stability is the residual frequency error remaining after the system frequency correction is applied and is intended for maintenance and debugging. In most architectures, this value will initially decrease from as high as 500 ppm to a nominal value in the range .01 to 0.1 ppm. If it remains high for some time after starting the daemon, something may be wrong with the local clock, or the value of the kernel variable .Va kern.clockrate.tick may be incorrect.
The .Sq broadcastdelay shows the default broadcast delay, as set by the .Ic broadcastdelay configuration command.
The
.Sq
authdelay
shows the default authentication delay,
as set by the
.Ic
authdelay
configuration command.
.Ss
"Runtime
Configuration
Requests"
All requests which cause state changes in the server are
authenticated by the server using a configured NTP key (the
facility can also be disabled by the server by not configuring a
key).
The key number and the corresponding key must also be made
known to
ntpdc
.
This can be done using the
.Ic
keyid
and
.Ic
passwd
commands, the latter of which will prompt at the terminal for a
password to use as the encryption key.
You will also be prompted
automatically for both the key number and password the first time a
command which would result in an authenticated request to the
server is given.
Authentication not only provides verification that
the requester has permission to make such changes, but also gives
an extra degree of protection again transmission errors.
Authenticated requests always include a timestamp in the packet data, which is included in the computation of the authentication code. This timestamp is compared by the server to its receive time stamp. If they differ by more than a small amount the request is rejected. This is done for two reasons. First, it makes simple replay attacks on the server, by someone who might be able to overhear traffic on your LAN, much more difficult. Second, it makes it more difficult to request configuration changes to your server from topologically remote hosts. While the reconfiguration facility will work well with a server on the local host, and may work adequately between time-synchronized hosts on the same LAN, it will work very poorly for more distant hosts. As such, if reasonable passwords are chosen, care is taken in the distribution and protection of keys and appropriate source address restrictions are applied, the run time reconfiguration facility should provide an adequate level of security.
The following commands all make authenticated requests.
ntpd(8)
.
ntpdc(8)
.
program and the monlist command or further information.
The default for this flag is enable.
ntp.conf(5)
for further information.
The default for this flag is disable.
.It
Xo
Ic
restrict
Ar
address
Ar
mask
.Ar
flag
Oo
Ar
...
Oc
.Xc
This command operates in the same way as the
.Ic
restrict
configuration file commands of
ntpd(8)
.
.It
Xo
Ic
unrestrict
Ar
address
Ar
mask
.Ar
flag
Oo
Ar
...
Oc
.Xc
Unrestrict the matching entry from the restrict list.
.It
Xo
Ic
delrestrict
Ar
address
Ar
mask
.Op
Cm
ntpport
.Xc
Delete the matching entry from the restrict list.
.It
Ic
readkeys
Causes the current set of authentication keys to be purged and
a new set to be obtained by rereading the keys file (which must
have been specified in the
ntpd(8)
configuration file).
This
allows encryption keys to be changed without restarting the
server.
.It
Ic
trustedkey
Ar
keyid
Oo
Ar
...
Oc
.It
Ic
untrustedkey
Ar
keyid
Oo
Ar
...
Oc
These commands operate in the same way as the
.Ic
trustedkey
and
.Ic
untrustedkey
configuration file
commands of
ntpd(8)
.
.It
Ic
authinfo
Returns information concerning the authentication module,
including known keys and counts of encryptions and decryptions
which have been done.
.It
Ic
traps
Display the traps set in the server.
See the source listing for
further information.
.It
Xo
Ic
addtrap
Ar
address
.Op
Ar
port
.Op
Ar
interface
.Xc
Set a trap for asynchronous messages.
See the source listing
for further information.
.It
Xo
Ic
clrtrap
Ar
address
.Op
Ar
port
.Op
Ar
interface
.Xc
Clear a trap for asynchronous messages.
See the source listing
for further information.
.It
Ic
reset
Clear the statistics counters in various modules of the server.
See the source listing for further information.
ntp.conf(5)
,
ntpd(8)
.Rs
.%A
David
L.
Mills
.%T
Network
Time
Protocol
(Version
3)
.%O
RFC1305
.Re
The formatting directives in this document came from FreeBSD.
The
ntpdc
utility is a crude hack.
Much of the information it shows is
deadly boring and could only be loved by its implementer.
The
program was designed so that new (and temporary) features were easy
to hack in, at great expense to the program's ease of use.
Despite
this, the program is occasionally useful.
Please report bugs to http://bugs.ntp.org .
The simplest use of this program is as an unprivileged command to check the current time, offset, and error in the local clock. For example:
ntpdc ntpserver.somewhere
With suitable privilege, it can be run as a command or in a
cron
job to reset the local clock from a reliable server, like
the ntpdate
and rdate
commands.
For example:
ntpdc -a ntpserver.somewhere