76
TimeHub 5500 User’s Guide
097-55501-01 Revision M – January 2009
Chapter 2 Engineering Ordering Information
NTP Server Card
When the two ports are not bonded:
Multicast will only use port A
Broadcast
– If two ports are on the same subnet, broadcast uses port A only
– If two ports are on different subnets, broadcast uses whichever port that is
on the same subnet as the broadcast address
If a broadcast/multicast address is not on the subnet of either port, its messages are
not transmitted.
Client (Peer)
A TimeHub NTP Server card can be a client only if it is not a primary server. In the
client role the NTP card can request time service from up to 8 peer NTP servers.
The secondary NTP Server card “assembles” the TOD using the timestamps from
the external peer NTP servers. In order to communicate with peer NTP servers, the
TimeHub NTP Server needs to know their IP addresses and share their
authentication MD5 key IDs, if authentication is used.
Authentication
The authentication used by TimeHub NTP is the MD-5 method in NTPv4 described
in the NTP Working Group Technical Report 06-6-1.
The main purpose of authentication is to detect hacking of the timestamps or other
information in the packet. Clients and secondary servers care about authenticity of
the NTP packets from the servers, because they use the timestamps in the NTP
packets to correct their local clocks. Primary NTP servers don't use other servers'
and clients' timestamps to correct its clock; it supports authentication primarily for
the benefits of clients and secondary servers. Authentication requires that both the
sender and the receiver of the NTP packets share the same keys. User can disable
authentication or specify a chosen key.
For each TimeHub NTP card up to 16 keys (and their corresponding key IDs) can
be defined. These 16 keys are shared with all trusted members on the network. In
other words, there are 16 keys for this network.
An NTPv4 packet has a 48 bytes header, plus zero or more optional extension
fields, plus a 20-byte message authenticator (4 bytes for key ID and 16 bytes for the
message digest). The message digest is calculated over the entire header plus the
optional extension fields. The 20-byte authenticator is optional if extension fields are
absent, but it is always present when extension fields are present.
Most unauthenticated NTP packets are 48 bytes long, and most authenticated NTP
packets are 68 bytes long. These are lengths before the packet is encapsulated into
lower protocol layers.
illustrates a sample NTPv4 packet.