6

I have a laptop running a version of Linux ( 3.12 ). I have ntpd installed and configured to sync with time.google.com. The problem I am having is if I am plugged into a network that only provides an IPV4 address, ntp's dns is using the ipv6 address:

    root@Node00b01973d6cc:~# ntpq -pn                                                                                           
     remote           refid      st t when poll reach   delay   offset  jitter                                              
==============================================================================                                              
 127.127.1.0     .LOCL.          10 l    7   64    1    0.000    0.000   0.002                                              
 ff0e::101       .MCST.          16 M    -   64    0    0.000    0.000   0.002                                              
 2001:4860:4806: .INIT.          16 u    -   64    0    0.000    0.000   0.000

Now, if I force ntpd to use only IPv4 DNS with the -4 option, everything works fine

root@Node00b01973d6cc:~# ntpq -pn 172.16.17.111                                                                             
     remote           refid      st t when poll reach   delay   offset  jitter                                              
==============================================================================                                              
 127.127.1.0     .LOCL.          10 l   60   64    1    0.000    0.000   0.002                                              
 216.239.35.12   .GOOG.           1 u   57   64    1   29.278  341.883   0.002

But I don't want to do this because if I go to a network that only gives IPv6 addresses this will fail. Is there a way to configure NTP to only use IPv4 ( or IPv6 ) if my interface actually has an IP address in that family?

The version of ntpd is 4.2.8p12. This is the ntp.conf file:

tinker panic 0                                                              
                                                            
driftfile /usr/local/etc/ntp.drift                                          
disable auth                                                                   
                                                                         
# Update the realtime clock and override its default                         
# stratum of 0.                                                                   
server time.google.com prefer #Real Time Clock                             
server 127.127.1.0 #Real Time Clock                           
server 127.127.1.0 #Real Time Clock                                         
fudge 127.127.1.0 stratum 10                                      
broadcast ff0e::101 iburst ttl 7

I have figured out the root cause of why this started to happen. I recently disabled IPv6 forwarding on my system. Once I turn IPv6 forwarding back on, NTP starts using the IPv4 address as I would expect.

Why would turning on ipv6 forwarding do this?

By default the system boots with IPv6 forwarding disabled. To turn it on, in one of the boot scripts I have the line:

sysctl -w net.ipv6.conf.all.forwarding=1
Improve this question
3
  • I don't know. I notice on my Fedora 29 system that getent hosts time.google.com returns IPv6 only, even though I do not have ipv6 access, but getent ahosts time.google.com returns all results in the correct preference order. So I tried enabling ipv6 forwarding at runtime, both in conf.all and in conf.wlp2s0, but it did not change the result of getent hosts time.google.com Commented Apr 6, 2019 at 20:08
  • 2
    To gain a working configuration, I guess you could try an ugly hack with two separate server lines. server -4 time.google.com and server -6 time.google.com. Commented Apr 6, 2019 at 20:09
  • I had similar problems on Windows using wget to download files, but they vanished in the meantime. My guess is that a nameserver when queried via IPv4 should answer with IPv4 addresses first, and when queried via IPv6, it should respond with IPv6 addresses first. In the past wget had tried to use IPv6, but could not connect; I had to specify the IPv4 address directly instead of the hostname to make it work. Commented Nov 24, 2023 at 8:49

2 Answers 2

Reset to default
3

Although the question is 2y old, the topic surely is not.

According to RFC-3484: Default Address Selection for IPv6 the OS automatically selects the best IP address, which is either IPv6 or IPv4.

If /etc/gai.conf is unchanged and your DNS works fine, then Linux (and many other OS) will prefer IPv6 address(es), otherwise it will choose IPv4, to connect to e.g. time.google.com.

You can check that using getent ahosts time.google.com. Every software should try all IP addresses of that list in that order, beginning at the top.

Where did your Linux get the timeservers from? If it is DHCP, then your OS cannot choose, because it got IPv4 IP addresses, not FQDNs. The NTP client may show reverse DNS hosts to IP addresses, not the real configured NTP server "names".

/edit: I tried with ntpd 4.2.8p15 and ntpd 4.2.6p5 on openSUSE 15.2 and CentOS 7: Both ntpd do not obey RFC 6742 (3484). However chronyd does.

/edit2: chronyd (3.4) seems to need a looooong time until v4 addresses will be used, if NTP servers are not reachable via IPv6; maybe try yourself.

Improve this answer
9
  • Where do you get "every software should try all ip addresses". That behaviour doesn't sound common behaviour . Usually if one A or AAAA record points to an offline server you will see sporadic connection failures. AFAIK if a client is consistently picking an AAAA record where ipv6 is given it causes failure to connect. Commented Apr 12, 2021 at 8:07
  • 1
    rfc3484 2. Well-behaved applications SHOULD iterate through the list of addresses returned from getaddrinfo() until they find a working address. besides that. I see this everyday when a postfix MTA try to send email but fails to connect via v6 .. it will then try v4 and succeeds. this is just one example of many. Commented Apr 12, 2021 at 11:06
  • 2
    @StefanKarest interesting. So here's the problem with this answer... The OP has come with a problem where ntp is not doing this. Your answer in response is "well it should", and you offer no information on how to force it to do so. More over, no standards are being broken as RFC 3484 only says "SHOULD" and not "MUST" (see rfc 2119). The problem with RFC 3484 is it has placed the responsibility on every application developer and taken it away from the OS developers. From experience there are a lot of exceptions where this rule is not followed! Commented Apr 12, 2021 at 11:25
  • @StefanKarest and now that I re-read it your statement "every software should try all ip addresses" is categorically incorrect because of RFC 2119: "This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item". It's incorrect to claim that SHOULD means "all software should" because valid exceptions are explicitly allowed. Commented Apr 12, 2021 at 11:33
  • as we do not know wether the ntp client in question uses FQDN or IP Adresses this ^^ discussion is meaningless. maybe I try with my NTP client (as this only uses a IPv4 address from dhcp). Commented Apr 12, 2021 at 11:49
0

Remove or comment out the IPv6 localhost from your hosts file:

#::1            localhost6.localdomain6 localhost6
Improve this answer
1
  • How does this remediate the problem? Commented May 20 at 11:43

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.