# NTP pool wrong time issue 2/5/20

**URL:** <https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570>\
**Category:** Client Configuration and Development\
**Tags:** monitoring, dns\
**Created:** [February 6, 2020, 4:33pm UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570 "2020-02-06T16:33:20Z")\
**Posts on this page:** 7\
**Page:** 2

<div class="post-metadata">

**Author:** ![littlejason99](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/littlejason99/32/242_2.png) [@littlejason99](https://community.ntppool.org/u/littlejason99)\
**Post date:** [February 7, 2020, 2:23pm UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/21 "2020-02-07T14:23:53Z")

</div>

> [@elljay](#):
>
> is an unroutable (local LAN) address.

Doh. Yeah, didn’t catch that… Still drinking my coffee this morning. LOL…

---

<div class="post-metadata">

**Author:** ![elljay](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@elljay](https://community.ntppool.org/u/elljay)\
**Post date:** [February 7, 2020, 2:26pm UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/22 "2020-02-07T14:26:12Z")

</div>

> [@littlejason99](#):
>
> ‘97.127.48.73’ was removed from the pool 2018-07-01.

Kinda implies server names aren’t being refreshed when unroutable and a very stale DNS lookup (1 year 7 months assuming the server was removed on that date!). That IP doesn’t respond to NTP requests from a web based “check my NTP server” page, so it seems to be both out of the pool and not replying to NTP queries.

---

<div class="post-metadata">

**Author:** ![elljay](https://avatars.discourse-cdn.com/v4/letter/e/5fc32e/32.png) [@elljay](https://community.ntppool.org/u/elljay)\
**Post date:** [February 7, 2020, 2:26pm UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/23 "2020-02-07T14:26:41Z")

</div>

Almost 3pm here - lots of caffeine already 😀

---

<div class="post-metadata">

**Author:** ![littlejason99](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/littlejason99/32/242_2.png) [@littlejason99](https://community.ntppool.org/u/littlejason99)\
**Post date:** [February 9, 2020, 2:10am UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/24 "2020-02-09T02:10:38Z")

</div>

Any new information?

---

<div class="post-metadata">

**Author:** ![erayd](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/erayd/32/85_2.png) [@erayd](https://community.ntppool.org/u/erayd)\
**Post date:** [February 9, 2020, 3:27am UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/25 "2020-02-09T03:27:14Z")

</div>

Something to consider, in light of that 172.16 server - if you had that NTP server on your network giving bad time, and firewall rules that prevent your servers from obtaining time from anywhere else (either outright blocks, or NAT all NTP traffic to the same host, or broken NAT), then that could be the cause, as your servers would have no other correct sources to compare it against. What does `ntpdate -q 172.16.1.70` say? That could explain why none of the pool addresses you were configured to use were providing bad time, but yet you still ended up with a massive offset.

I’ve seen this happen before in a network where somebody set up an NTP server for public access, disabled connection tracking for all 123/UDP, and didn’t realise that doing so also means that none of the clients behind NAT will be able to access public NTP servers as a result (because no connection tracking means the router has no idea where to route the replies, and will therefore simply drop them). The only NTP server that replies could be received from was an internal one with a private IP - which had a clock that was way off, and was unmaintained. It was also being advertised by DHCP, but I’m not sure how many clients picked it up that way vs manual config or DNS.

---

<div class="post-metadata">

**Author:** ![steve2030](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@steve2030](https://community.ntppool.org/u/steve2030)\
**Post date:** [February 11, 2020, 2:49pm UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/26 "2020-02-11T14:49:54Z")

</div>

> [@erayd](#):
>
> `ntpdate -q 172.16.1.70` say?

When I pulled the logs, that server that was internal was the last in the set of requst in the list. Everything earlier was NTP servers.

---

<div class="post-metadata">

**Author:** ![ask](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/ask/32/907_2.png) [@ask](https://community.ntppool.org/u/ask)\
**Post date:** [February 12, 2020, 5:48am UTC](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570/27 "2020-02-12T05:48:54Z")

</div>

@steve2030 As others said, spot checking the IPs from your logs they all have had good performance. Looking in the monitoring logs “40 minutes off” hasn’t happened in tens of millions of monitoring checks (I only looked back a year).

Without more trouble reports, it being 40 minutes for multiple people running the same platform(?) seems too much like a coincidence.

[Previous page](https://community.ntppool.org/t/ntp-pool-wrong-time-issue-2-5-20/1570.md?page=1)
