the occasional query to an ntp server.
Every night, between 01:30 and 08:00, there is a query to x.debian.pool.ntp.org every 5 seconds. Pi-hole is running on a Sparky SBC, using DietPi as the OS. Pi-hole was installed via DietPi's software installer.
The time on the Sparky is correct.
Assuming, the query is from the pi (you don't specify a client).
This could indicate you are using ntp, and there is a problem...
which ntpd, this should reply somethink like /usr/sbin/ntpd (on Raspbian)ntpd is installed, check your ntp configuration (/etc/ntp.conf - on Raspbian)There should be something like
pool 0.debian.pool.ntp.org iburst
pool 1.debian.pool.ntp.org iburst
pool 2.debian.pool.ntp.org iburst
pool 3.debian.pool.ntp.org iburst
in that file, certainly NOT x.debian.pool.ntp.org
If the entry is incorrect, modify the entry (or entries).
If the entries are correct, verify you can resolve the domain, using nslookup:
nslookup
> 0.debian.pool.ntp.org
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
Name: 0.debian.pool.ntp.org
Address: 94.224.67.24
Name: 0.debian.pool.ntp.org
Address: 85.88.55.5
Name: 0.debian.pool.ntp.org
Address: 193.104.37.238
> 1.debian.pool.ntp.org
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
Name: 1.debian.pool.ntp.org
Address: 81.83.15.62
Name: 1.debian.pool.ntp.org
Address: 193.190.253.212
Name: 1.debian.pool.ntp.org
Address: 77.109.90.72
> 2.debian.pool.ntp.org
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
Name: 2.debian.pool.ntp.org
Address: 195.200.224.66
Name: 2.debian.pool.ntp.org
Address: 85.88.55.5
Name: 2.debian.pool.ntp.org
Address: 91.121.216.238
> 3.debian.pool.ntp.org
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
Name: 3.debian.pool.ntp.org
Address: 51.38.2.120
Name: 3.debian.pool.ntp.org
Address: 94.143.184.140
Name: 3.debian.pool.ntp.org
Address: 94.224.67.24
If you can't resolve the domain names, you can either look for the reason why you can't resolve them OR replace the entries with your regional servers, e.g. 1.debian.pool.ntp.org becomes (for europe) 1.europe.pool.ntp.org (check again with nslookup).
After you have made any modifications to the file enter (on Raspbian):
sudo /etc/init.d/ntp stop
sudo ntpd -gq
sudo /etc/init.d/ntp start
Sorry, when I wrote x.debian.pool.ntp.org, I meant that the x could be replaced by 0, 1, 2, or 3. All addresses are being queried. All addresses are also being resolved correctly, e.g:
nslookup
> 0.debian.pool.ntp.org
Server: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
Name: 0.debian.pool.ntp.org
Address: 83.162.149.224
Name: 0.debian.pool.ntp.org
Address: 87.233.197.123
Name: 0.debian.pool.ntp.org
Address: 213.109.127.82
Name: 0.debian.pool.ntp.org
Address: 5.39.184.5
>
which ntpd doesn't seem to do anything on DietPi, so I don't know if this means that ntpd is not installed (I know very little about the Linux environment).
Might need sudo:
sudo which ntpd
Or check if its listening:
sudo netstat -nltup | grep :123
I'm not having much luck here:
root@DietPi:~# sudo which ntpd
root@DietPi:~# sudo netstat -nltup | grep :123
sudo: netstat: command not found
root@DietPi:~#
sudo ss -np | grep ntp
ps -C ntpd
ntpq -p
apt policy ntp
EDIT: added one
Ps. you havn't mentioned from which IP/device these queries are coming from ?
Which client makes the query? Is it the pi OR another client?
Possible firewall problem?
From a windows machine, that uses pihole DNS, run:
w32tm /stripchart /computer:0.debian.pool.ntp.org /dataonly /samples:5
result should be something like:
Tracking 0.debian.pool.ntp.org [51.38.2.120:123].
Collecting 5 samples.
The current time is 18-Jun-19 6:51:26 AM.
06:51:26, -02.7711642s
06:51:28, -02.7722184s
06:51:30, -02.7719083s
06:51:32, -02.7728847s
06:51:34, -02.7728659s
These queries are all coming from the Sparky SBC where pi-hole is running. It's being used as an audio USB bridge. It may well be something that the Allo.com audio software is doing that is causing this. I'll try moving Pi-hole across to a RPi, and run it in isolation there, and then see what happens.
Interesting. Now that pi-hole is running on its own RPi, I am no longer seeing the queries to the ntp service. It must have been some sort of interaction between pi-hole and other software running on the Sparky SBC? This topic can be closed.
Pi-hole running on the Sparky SBC:
Pi-hole running on the RPi:
Pi-Hole does not initiate any ntp requests; the log is showing the queries Pi-Hole received for resolution. The other software would be the source of your ntp queries.
+1
I agree probably a firewall problem.I've been down that road and have also seen the continuous request.
Sorry but I gave you wrong info probably.
My Pi-hole setup was upgraded from Wheezy to Jessie to Stretch so it still had old fashion ntpd installed for syncing time.
Current distro's use below:
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.
