1、ESXi與NTP服務器同步的抓包測試問題：ESXi配置NTP時間同步時，當指向由Windows系統搭建的NTP服務器時，無法實現同步，而指向由Linux系統搭建的NTP服務器時，則可以實現同步。為查找問題根源，專門搭建了測試環境，進行抓包分析，研究其中發生的過程。測試環境： 序號名稱IP Address系統版本作用1ESXi Server22ESXi5.0ESXi服務器，作為NTP客戶端2Router1919Windows 2003配置了路由功能，并安裝抓包工具3NTP Server1Win

2、dows2003搭建NTP服務器4NTP Server2Rhel5.5搭建NTP服務器拓撲圖：測試ESXi使用Windows 2003搭建NTP的服務器按照VMware提供KB的建議， 0 970354356 1.配置Windows 2003，搭建NTP客戶端修改注冊表，步驟如下：1.Enable NTP mode:Locate HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeParametersSet the Type value to NTP.2.Enable the NTP Client:Locat

3、e HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeConfigSet the AnnounceFlags value to 5.3.Specify the upstream NTP servers to sync from:Locate HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeTimeProvidersSet the NtpServer value to a list of at least 3 NTP servers.Example: You might

4、set the value to:,0x1 2.,0x1 3.,0x1Note: On a Windows 2008 Domain Controller, NtpServer is located in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeParameters.4.Specify a 15-minute update interval:Locate HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW

5、32TimeTimeProvidersNtpClientSet the SpecialPollInterval value to 900.5.Restart the W32time service for the changes to take effect.2.配置ESXi Server，將其NTP服務器指向由Windows搭建的NTP服務器1.Open the /etc/ntp.conf file in a text editor. For more information, see Editing configuration files in VMware ESXi and ESX (1

6、017022).2.Add the tos maxdist command on its own line:tos maxdist 303.Save and close the configuration file.4.Make the /etc/likewise/lsassd.conf file writable by running the command:chmod +w /etc/likewise/lsassd.conf5.Open the /etc/likewise/lsassd.conf file in a text editor. For more information, se

7、e Editing configuration files in VMware ESXi and ESX (1017022).6.Locate the sync-system-time option, uncomment it, and set the value to no:sync-system-time = no7.Save and close the configuration file.8.On ESXi, save the configuration changes to the boot bank so they persist across reboots by running

8、 the command:/sbin/auto-backup.sh9.Restart the ntpd and lsassd services for the configuration changes to take effect by running the commands:service lsassd restartservice ntpd restartNote: To restart the ntpd and lsassd services on an ESXi host, run these commands:./etc/init.d/lsassd restart./etc/in

9、it.d/ntpd restart3.配置ESXi的NTP服務器地址4.監控數據包只有從ESXi發出的NTP包，NTP server沒有回復。5.在KB的基礎上做調整，修改注冊表，啟動NTP服務修改注冊表的鍵值:Run->regedit HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32Time TimeProvidersNtpServer內的Enabled為1，打開NTP服務器功能（默認是不開啟NTP Server服務重啟W23Time服務6.啟動NTP服務后，抓包顯示NTP服務器有了回復7.NTP數據包ESXi 發出的NTP請求包

10、是NTP版本4.Windows搭建的NTP Server的響應包是NTP版本3ESXi未完成時間同步，NTP服務器發回的響應包并未被接受。測試ESXi使用Linux搭建NTP的服務器1.配置Linux作為NTP服務器1.編輯ntp.conf2.Ntp.conf配置示例：# Permit time synchronization with our time source, but do not# permit the source to query or modify the service on this system.restrict default nomodify# Permit all

11、 access over the loopback interface. This could# be tightened as well, but to do so would effect some of# the administrative functions.restrict # - CLIENT NETWORK -# Permit systems on this network to synchronize with this# time service. Do not permit those systems to modify the# configurati

12、on of this service. Also, do not use those# systems as peers for synchronization.# restrict mask nomodify notrap# - OUR TIMESERVERS - server 0.server 1.server 2.# - NTP MULTICASTCLIENT -#multicastclient# listen on default # restr

13、ict mask 55 nomodify notrap# restrict mask nomodify notrap# - GENERAL CONFIGURATION -# Undisciplined Local Clock. This is a fake driver intended for backup# and when no outside source of synchronized time is available. The# default stratum is usually

14、3, but in this case we elect to use stratum# 0. Since the server line does not have the prefer keyword, this driver# is never used for synchronization, unless no other other# synchronization source is available. In case the local host is# controlled by some external source, such as an external oscil

15、lator or# another protocol, the prefer keyword would cause the local host to# disregard all other synchronization sources, unless the kernel# modifications are in use and declare an unsynchronized condition.#server# local clockfudge stratum 10# Drift file. Put this in a directo

16、ry which the daemon can write to.# No symbolic links allowed, either, since the daemon updates the file# by creating a temporary in the same directory and then rename()'ing# it to the file.#driftfile /var/lib/ntp/driftbroadcastdelay0.008# Keys file. If you want to diddle your server at run time,

17、 make a# keys file (mode 600 for sure) and define the key number to be# used for making requests.# PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote# systems might be able to reset your clock at will. Note also that# ntpd is started with a -A flag, disabling authentication, that# will have to be removed as well.#keys/etc/ntp/keys3. Linux防火墻啟動123端口2.更改ESXi的NTP服務器，將其指向Linux服務器的IP：3.NTP數據包內容1. 總共發了20個ntp請