|
| 1 | +# NetworkTime Plugin |
| 2 | + |
| 3 | +Plugin extract and export various data from NTP packets. |
| 4 | + |
| 5 | +## Features |
| 6 | + |
| 7 | +- Calculates and exports statistical properties of the flow based on packet lengths. |
| 8 | +- Expects traffic to be on port 123. |
| 9 | +- Immediately terminates the flow after processing the first NTP packet. |
| 10 | + |
| 11 | +## Output Fields |
| 12 | + |
| 13 | +| Field Name | Data Type | Description | |
| 14 | +| ---------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------ | |
| 15 | +| `NTP_LEAP` | `uint8_t` | Leap from Network Time header. | |
| 16 | +| `NTP_MODE` | `uint8_t` | Mode from Network Time header. | |
| 17 | +| `NTP_VERSION` | `uint8_t` | Version from Network Time header. | |
| 18 | +| `NTP_STRATUM` | `uint8_t` | Stratum used to identify the distance from the reference clock. | |
| 19 | +| `NTP_POLL` | `int8_t` | The poll interval in seconds (as a power of 2) indicating how often the client queries the server. | |
| 20 | +| `NTP_PRECISION` | `int8_t` | The precision of the local clock, i.e., the smallest distinguishable time interval, usually expressed as a negative power of 2 in seconds. | |
| 21 | +| `NTP_DELAY` | `uint32_t` | The round-trip network delay between the client and the NTP server, measured in milliseconds or seconds. | |
| 22 | +| `NTP_DISPERSION` | `uint32_t` | The estimated error or uncertainty of the server's time relative to the true time, increases over time since last update. | |
| 23 | +| `NTP_REF_ID` | `string` | Identifier of the reference clock or server the NTP server is synchronized to as a string. | |
| 24 | +| `NTP_REF` | `string` | Timestamp of the last time the server clock was set or corrected as a string. | |
| 25 | +| `NTP_ORIG` | `string` | Timestamp sent by the client in the request packet as a string. | |
| 26 | +| `NTP_RECV` | `string` | Timestamp when the request was received by the server as a string. | |
| 27 | +| `NTP_SENT` | `string` | Timestamp when the response was sent by the server as a string. | |
| 28 | + |
| 29 | +## Usage |
| 30 | + |
| 31 | +### YAML Configuration |
| 32 | + |
| 33 | +Add the plugin to your ipfixprobe YAML configuration: |
| 34 | + |
| 35 | +```yaml |
| 36 | +process_plugins: |
| 37 | + - ntp |
| 38 | +``` |
| 39 | +
|
| 40 | +### CLI Usage |
| 41 | +
|
| 42 | +You can also enable the plugin directly from the command line: |
| 43 | +
|
| 44 | +`ipfixprobe -p ntp ...` |
0 commit comments