NTS Pool: pool NTP server listen port, fixed to 123?

[boretom]

Preface: I don't have any technical knowledge of the internal workings of NTP or NTS, I'm a server admin.

While setting up to use swedish Netnod NTS servers for use on a Hetzner cloud server in Finland, I realised that their NTP servers listen on port 4123/udp. I'm not sure how it's done but - I need to do more reading on that - by NTP extension fields?

If I use that Hetzner cloud server of mine as a normal NTS server and set the NTP port to a custom port, it does work. I tested the functionality by running 'chronyd -Q5 "server iburst nts maxsamples 1"', chrony reports that the port has changed to my custom port and returns how much the system clock is off.

Is the NTP listen port required to be set to 123 at the moment to take part in the NTS pool (not an issue at all, just a question :) )?

I come to that question because I set it to 4123 on one of the servers and although the "Time Sources" website reports increasing score (10+) there were no clients with NTP connections after 3 or 4 hours. As soon as I set it back to 123 I got one connection.

[davidv1992]

It is not currently a requirement that the NTP listen port is 123 to join the NTS pool. So long as your key exchange server properly indicates the port to be used for the ntp traffic to be the alternate port our monitoring will judge the server as correctly functioning and advertise it to clients.

As for the number of connections you are seeing, this may be a consequence of relatively little client traffic on the pool at the moment. There is only on the order of a few clients per hour on the pool at the moment, so a server may only be getting one actual client assigned to it every few hours or so.

[boretom]

It is not currently a requirement that the NTP listen port is 123 to join the NTS pool.

I see, good to have it confirmed, thank you :)

As for the number of connections you are seeing, this may be a consequence of relatively little client traffic on the pool at the moment.

That would certainly explain it, I'll change the NTP port on one of the three server to not-123 and let it run for a bit. If I don't see any connection (disregarding the NTS pool IPs) within a day or two, I'll debug it using tcpdump to see if there are requests coming in on 123 (the server are not published anywhere else).

[boretom]

I can confirm it works excellent, thank you.

After I setup a server in Switzerland and added it to the NTS pool, this server is now used when I connect to the pool from a client with a Swiss IP. The server uses NTP port 4123 and Chrony as a client and as a server are working well together.

# chronyc -n sources
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* 185.203.114.105               2   7   377    54  -3414us[-2138us] +/-   62ms
^+ 2001:678:8::123               2   7   377    45  -1558us[-1558us] +/-   58ms
^+ 194.0.5.123                   2   7   377    43  +2903us[+2903us] +/-   64ms
^+ 77.42.37.85                   2   7   377   104  -9307us[-8001us] +/-   76ms

On the other server which uses port 123, turns out most of the clients were scanner. And they did not scan for port 4123 and that seems to be the reason the clients list was almost empty.