scapy.layers.ntp

NTP (Network Time Protocol). References : RFC 5905, RC 1305, ntpd source code

class scapy.layers.ntp.NTP

Bases: scapy.packet.Packet

Base class that allows easier instantiation of a NTP packet from binary data.

aliastypes
classmethod dispatch_hook(_pkt=None, *args, **kargs)

Returns the right class for the given data.

getlayer(cls, nb=1, _track=None, _subclass=True, **flt)
haslayer(cls)

Specific: NTPHeader().haslayer(NTP) should return True.

mysummary()
pre_dissect(s)

Check that the payload is long enough to build a NTP packet.

class scapy.layers.ntp.NTPAuthenticator

Bases: scapy.packet.Packet

Packet handling the “authenticator” part of a NTP packet, as defined in RFC 5905.

aliastypes
extract_padding(s)
fields_desc
NTPAuthenticator fields

padding

_NTPAuthenticatorPaddingField

b''

key_id

IntField

0

dgst

XStrFixedLenField

b''

class scapy.layers.ntp.NTPClockStatusPacket

Bases: scapy.packet.Packet

Packet handling the clock status fields.

aliastypes
extract_padding(s)
fields_desc
NTPClockStatusPacket fields

clock_status

BitEnumField (8 bits)

0

code

BitField (8 bits)

0

class scapy.layers.ntp.NTPConfPeer

Bases: scapy.packet.Packet

Structure for passing peer configuration information.

aliastypes
fields_desc
NTPConfPeer fields

peeraddr

IPField

'0.0.0.0'

hmode

ByteField

0

version

ByteField

0

minpoll

ByteField

0

maxpoll

ByteField

0

flags

FlagsField (8 bits)

<Flag 0 ()>

ttl

ByteField

0

unused1

ShortField

0

keyid

IntField

0

keystr

StrFixedLenField

b''

v6_flag

IntField

0

unused2

IntField

0

peeraddr6

IP6Field

'::'

class scapy.layers.ntp.NTPConfRestrict

Bases: scapy.packet.Packet

Structure used for specifying restrict entries.

aliastypes
fields_desc
NTPConfRestrict fields

addr

IPField

'0.0.0.0'

mask

IPField

'0.0.0.0'

flags

FlagsField (16 bits)

<Flag 0 ()>

m_flags

ShortField

0

v6_flag

IntField

0

addr6

IP6Field

'::'

mask6

IP6Field

'::'

class scapy.layers.ntp.NTPConfTrap

Bases: scapy.packet.Packet

Structure used to pass add/clear trap information to the client

aliastypes
fields_desc
NTPConfTrap fields

local_address

IPField

'0.0.0.0'

trap_address

IPField

'0.0.0.0'

trap_port

ShortField

0

unused

ShortField

0

v6_flag

IntField

0

local_address6

IP6Field

'::'

trap_address6

IP6Field

'::'

class scapy.layers.ntp.NTPConfUnpeer

Bases: scapy.packet.Packet

Structure for passing peer deletion information.

aliastypes
fields_desc
NTPConfUnpeer fields

peeraddr

IPField

'0.0.0.0'

v6_flag

IntField

0

peeraddr6

IP6Field

'::'

class scapy.layers.ntp.NTPControl

Bases: scapy.layers.ntp.NTP

Packet handling NTP mode 6 / “Control” messages.

aliastypes
fields_desc
NTPControl fields

zeros

BitField (2 bits)

0

version

BitField (3 bits)

2

mode

BitField (3 bits)

6

response

BitField (1 bit)

0

err

BitField (1 bit)

0

more

BitField (1 bit)

0

op_code

BitEnumField (5 bits)

0

sequence

ShortField

0

status_word

NTPControlStatusField (Cond)

b''

status

ShortField (Cond)

0

association_id

ShortField

0

offset

ShortField

0

count

ShortField

None

data

NTPControlDataPacketLenField

b''

authenticator

PacketField

b''

post_build(p, pay)
class scapy.layers.ntp.NTPControlDataPacketLenField(name, default, cls, length_from=None)

Bases: scapy.fields.PacketLenField

PacketField handling the “data” field of NTP control messages.

getfield(pkt, s)
m2i(pkt, m)
class scapy.layers.ntp.NTPControlStatusField(name, default, cls, remain=0)

Bases: scapy.fields.PacketField

This field provides better readability for the “status” field.

m2i(pkt, m)
class scapy.layers.ntp.NTPErrorStatusPacket

Bases: scapy.packet.Packet

Packet handling the error status fields.

aliastypes
extract_padding(s)
fields_desc
NTPErrorStatusPacket fields

error_code

BitEnumField (8 bits)

0

reserved

BitField (8 bits)

0

class scapy.layers.ntp.NTPExtPacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketListField

PacketListField handling NTPv4 extensions (NTPExtension list).

getfield(pkt, s)
m2i(pkt, m)
class scapy.layers.ntp.NTPExtension

Bases: scapy.packet.Packet

Packet handling a NTPv4 extension.

aliastypes
fields_desc
NTPExtension fields

type

ShortField

0

len

ShortField

0

value

PadField

b''

class scapy.layers.ntp.NTPExtensions

Bases: scapy.packet.Packet

Packet handling the NTPv4 extensions and the “MAC part” of the packet.

aliastypes
fields_desc
NTPExtensions fields

extensions

NTPExtPacketListField

[]

mac

PacketField

<NTPAuthenticator  |>

class scapy.layers.ntp.NTPHeader

Bases: scapy.layers.ntp.NTP

Packet handling the RFC 5905 NTP packet.

aliastypes
fields_desc
NTPHeader fields

leap

BitEnumField (2 bits)

0

version

BitField (3 bits)

4

mode

BitEnumField (3 bits)

3

stratum

BitField (8 bits)

2

poll

BitField (8 bits)

10

precision

BitField (8 bits)

0

delay

FixedPointField (32 bits)

0

dispersion

FixedPointField (32 bits)

0

id

IPField (Cond)

'127.0.0.1'

ref_id

StrFixedLenEnumField (Cond)

b''

ref

TimeStampField (64 bits)

0

orig

TimeStampField (64 bits)

None

recv

TimeStampField (64 bits)

0

sent

TimeStampField (64 bits)

None

guess_payload_class(payload)

Handles NTPv4 extensions and MAC part (when authentication is used.)

class scapy.layers.ntp.NTPInfoAuth

Bases: scapy.packet.Packet

Structure used to return information concerning the authentication module.

aliastypes
fields_desc
NTPInfoAuth fields

timereset

IntField

0

numkeys

IntField

0

numfreekeys

IntField

0

keylookups

IntField

0

keynotfound

IntField

0

encryptions

IntField

0

decryptions

IntField

0

expired

IntField

0

keyuncached

IntField

0

class scapy.layers.ntp.NTPInfoControl

Bases: scapy.packet.Packet

Structure used to return statistics from the control module.

aliastypes
fields_desc
NTPInfoControl fields

ctltimereset

IntField

0

numctlreq

IntField

0

numctlbadpkts

IntField

0

numctlresponses

IntField

0

numctlfrags

IntField

0

numctlerrors

IntField

0

numctltooshort

IntField

0

numctlinputresp

IntField

0

numctlinputfrag

IntField

0

numctlinputerr

IntField

0

numctlbadoffset

IntField

0

numctlbadversion

IntField

0

numctldatatooshort

IntField

0

numctlbadop

IntField

0

numasyncmsgs

IntField

0

class scapy.layers.ntp.NTPInfoIOStats

Bases: scapy.packet.Packet

I/O statistics.

aliastypes
fields_desc
NTPInfoIOStats fields

timereset

IntField

0

totalrecvbufs

ShortField

0

freerecvbufs

ShortField

0

fullrecvbufs

ShortField

0

lowwater

ShortField

0

dropped

IntField

0

ignored

IntField

0

received

IntField

0

sent

IntField

0

notsent

IntField

0

interrupts

IntField

0

int_received

IntField

0

class scapy.layers.ntp.NTPInfoIfStatsIPv4

Bases: scapy.packet.Packet

Interface statistics.

aliastypes
fields_desc
NTPInfoIfStatsIPv4 fields

unaddr

PadField

'0.0.0.0'

unbcast

PadField

'0.0.0.0'

unmask

PadField

'0.0.0.0'

v6_flag

IntField

0

ifname

StrFixedLenField

b''

flags

IntField

0

last_ttl

IntField

0

num_mcast

IntField

0

received

IntField

0

sent

IntField

0

notsent

IntField

0

uptime

IntField

0

scopeid

IntField

0

ifindex

IntField

0

ifnum

IntField

0

peercnt

IntField

0

family

ShortField

0

ignore_packets

ByteField

0

action

ByteField

0

_filler0

IntField

0

class scapy.layers.ntp.NTPInfoIfStatsIPv6

Bases: scapy.packet.Packet

Interface statistics.

aliastypes
fields_desc
NTPInfoIfStatsIPv6 fields

unaddr

IP6Field

'::'

unbcast

IP6Field

'::'

unmask

IP6Field

'::'

v6_flag

IntField

0

ifname

StrFixedLenField

b''

flags

IntField

0

last_ttl

IntField

0

num_mcast

IntField

0

received

IntField

0

sent

IntField

0

notsent

IntField

0

uptime

IntField

0

scopeid

IntField

0

ifindex

IntField

0

ifnum

IntField

0

peercnt

IntField

0

family

ShortField

0

ignore_packets

ByteField

0

action

ByteField

0

_filler0

IntField

0

class scapy.layers.ntp.NTPInfoKernel

Bases: scapy.packet.Packet

Structure used for returning kernel pll/PPS information

aliastypes
fields_desc
NTPInfoKernel fields

offset

IntField

0

freq

IntField

0

maxerror

IntField

0

esterror

IntField

0

status

ShortField

0

shift

ShortField

0

constant

IntField

0

precision

IntField

0

tolerance

IntField

0

ppsfreq

IntField

0

jitter

IntField

0

stabil

IntField

0

jitcnt

IntField

0

calcnt

IntField

0

errcnt

IntField

0

stbcnt

IntField

0

class scapy.layers.ntp.NTPInfoLoop

Bases: scapy.packet.Packet

Loop filter variables.

aliastypes
fields_desc
NTPInfoLoop fields

last_offset

TimeStampField (64 bits)

0

drift_comp

TimeStampField (64 bits)

0

compliance

IntField

0

watchdog_timer

IntField

0

class scapy.layers.ntp.NTPInfoMemStats

Bases: scapy.packet.Packet

Peer memory statistics.

aliastypes
fields_desc
NTPInfoMemStats fields

timereset

IntField

0

totalpeermem

ShortField

0

freepeermem

ShortField

0

findpeer_calls

IntField

0

allocations

IntField

0

demobilizations

IntField

0

hashcount

FieldListField

[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0]

class scapy.layers.ntp.NTPInfoMonitor1

Bases: scapy.packet.Packet

Structure used for returning monitor data.

aliastypes
fields_desc
NTPInfoMonitor1 fields

lasttime

IntField

0

firsttime

IntField

0

lastdrop

IntField

0

count

IntField

0

addr

IPField

'0.0.0.0'

daddr

IPField

'0.0.0.0'

flags

IntField

0

port

ShortField

0

mode

ByteField

0

version

ByteField

0

v6_flag

IntField

0

unused1

IntField

0

addr6

IP6Field

'::'

daddr6

IP6Field

'::'

class scapy.layers.ntp.NTPInfoPeer

Bases: scapy.packet.Packet

Peer information structure.

aliastypes
fields_desc
NTPInfoPeer fields

dstaddr

IPField

'0.0.0.0'

srcaddr

IPField

'0.0.0.0'

srcport

ShortField

0

flags

FlagsField (8 bits)

<Flag 0 ()>

leap

ByteField

0

hmode

ByteEnumField

0

pmode

ByteField

0

stratum

ByteField

0

ppoll

ByteField

0

hpoll

ByteField

0

precision

SignedByteField

0

version

ByteField

0

unused8

ByteField

0

reach

ByteField

0

unreach

ByteField

0

flash

XByteField

0

ttl

ByteField

0

flash2

XLEShortField

0

associd

ShortField

0

keyid

LEIntField

0

pkeyid

IntField

0

refid

IPField

0

timer

IntField

0

rootdelay

FixedPointField (32 bits)

0

rootdispersion

FixedPointField (32 bits)

0

reftime

TimeStampField (64 bits)

0

org

TimeStampField (64 bits)

0

rec

TimeStampField (64 bits)

0

xmt

TimeStampField (64 bits)

0

filtdelay

FieldListField

[0, 0, 0, 0, 0, 0, 0, 0]

filtoffset

FieldListField

[0, 0, 0, 0, 0, 0, 0, 0]

order

FieldListField

[0, 0, 0, 0, 0, 0, 0, 0]

delay

FixedPointField (32 bits)

0

dispersion

FixedPointField (32 bits)

0

offset

TimeStampField (64 bits)

0

selectdisp

FixedPointField (32 bits)

0

unused1

IntField

0

unused2

IntField

0

unused3

IntField

0

unused4

IntField

0

unused5

IntField

0

unused6

IntField

0

unused7

IntField

0

estbdelay

FixedPointField (32 bits)

0

v6_flag

IntField

0

unused9

IntField

0

dstaddr6

IP6Field

'::'

srcaddr6

IP6Field

'::'

class scapy.layers.ntp.NTPInfoPeerList

Bases: scapy.packet.Packet

Used to return raw lists of peers.

aliastypes
fields_desc
NTPInfoPeerList fields

addr

IPField

'0.0.0.0'

port

ShortField

0

hmode

ByteEnumField

0

flags

FlagsField (8 bits)

<Flag 0 ()>

v6_flag

IntField

0

unused1

IntField

0

addr6

IP6Field

'::'

class scapy.layers.ntp.NTPInfoPeerStats

Bases: scapy.packet.Packet

Peer statistics structure.

aliastypes
fields_desc
NTPInfoPeerStats fields

dstaddr

IPField

'0.0.0.0'

srcaddr

IPField

'0.0.0.0'

srcport

ShortField

0

flags

FlagsField (16 bits)

<Flag 0 ()>

timereset

IntField

0

timereceived

IntField

0

timetosend

IntField

0

timereachable

IntField

0

sent

IntField

0

unused1

IntField

0

processed

IntField

0

unused2

IntField

0

badauth

IntField

0

bogusorg

IntField

0

oldpkt

IntField

0

unused3

IntField

0

unused4

IntField

0

seldisp

IntField

0

selbroken

IntField

0

unused5

IntField

0

candidate

ByteField

0

unused6

ByteField

0

unused7

ByteField

0

unused8

ByteField

0

v6_flag

IntField

0

unused9

IntField

0

dstaddr6

IP6Field

'::'

srcaddr6

IP6Field

'::'

class scapy.layers.ntp.NTPInfoPeerSummary

Bases: scapy.packet.Packet

Sort of the info that ntpdc returns by default.

aliastypes
fields_desc
NTPInfoPeerSummary fields

dstaddr

IPField

'0.0.0.0'

srcaddr

IPField

'0.0.0.0'

srcport

ShortField

0

stratum

ByteField

0

hpoll

ByteField

0

ppoll

ByteField

0

reach

ByteField

0

flags

FlagsField (8 bits)

<Flag 0 ()>

hmode

ByteField

{0: 'reserved', 1: 'symmetric active', 2: 'symmetric passive', 3: 'client', 4: 'server', 5: 'broadcast', 6: 'NTP control message', 7: 'reserved for private use'}

delay

FixedPointField (32 bits)

0

offset

TimeStampField (64 bits)

0

dispersion

FixedPointField (32 bits)

0

v6_flag

IntField

0

unused1

IntField

0

dstaddr6

IP6Field

'::'

srcaddr6

IP6Field

'::'

class scapy.layers.ntp.NTPInfoSys

Bases: scapy.packet.Packet

System info. Mostly the sys.* variables, plus a few unique to the implementation.

aliastypes
fields_desc
NTPInfoSys fields

peer

IPField

'0.0.0.0'

peer_mode

ByteField

0

leap

ByteField

0

stratum

ByteField

0

precision

ByteField

0

rootdelay

FixedPointField (32 bits)

0

rootdispersion

FixedPointField (32 bits)

0

refid

IPField

0

reftime

TimeStampField (64 bits)

0

poll

IntField

0

flags

FlagsField (8 bits)

<Flag 0 ()>

unused1

ByteField

0

unused2

ByteField

0

unused3

ByteField

0

bdelay

FixedPointField (32 bits)

0

frequency

FixedPointField (32 bits)

0

authdelay

TimeStampField (64 bits)

0

stability

FixedPointField (32 bits)

0

v6_flag

IntField

0

unused4

IntField

0

peer6

IP6Field

'::'

class scapy.layers.ntp.NTPInfoSysStats

Bases: scapy.packet.Packet

System stats. These are collected in the protocol module.

aliastypes
fields_desc
NTPInfoSysStats fields

timeup

IntField

0

timereset

IntField

0

denied

IntField

0

oldversionpkt

IntField

0

newversionpkt

IntField

0

unknownversion

IntField

0

badlength

IntField

0

processed

IntField

0

badauth

IntField

0

received

IntField

0

limitrejected

IntField

0

class scapy.layers.ntp.NTPInfoTimerStats

Bases: scapy.packet.Packet

Timer stats.

aliastypes
fields_desc
NTPInfoTimerStats fields

timereset

IntField

0

alarms

IntField

0

overflows

IntField

0

xmtcalls

IntField

0

class scapy.layers.ntp.NTPPeerStatusDataPacket

Bases: scapy.packet.Packet

Packet handling the data field when op_code is CTL_OP_READSTAT and the association_id field is null.

aliastypes
fields_desc
NTPPeerStatusDataPacket fields

association_id

ShortField

0

peer_status

PacketField

<NTPPeerStatusPacket  |>

class scapy.layers.ntp.NTPPeerStatusPacket

Bases: scapy.packet.Packet

Packet handling the peer status fields.

aliastypes
extract_padding(s)
fields_desc
NTPPeerStatusPacket fields

configured

BitField (1 bit)

0

auth_enabled

BitField (1 bit)

0

authentic

BitField (1 bit)

0

reachability

BitField (1 bit)

0

reserved

BitField (1 bit)

0

peer_sel

BitEnumField (3 bits)

0

peer_event_counter

BitField (4 bits)

0

peer_event_code

BitEnumField (4 bits)

0

class scapy.layers.ntp.NTPPrivate

Bases: scapy.layers.ntp.NTP

Packet handling the private (mode 7) messages.

aliastypes
fields_desc
NTPPrivate fields

response

BitField (1 bit)

0

more

BitField (1 bit)

0

version

BitField (3 bits)

2

mode

BitField (3 bits)

0

auth

BitField (1 bit)

0

seq

BitField (7 bits)

0

implementation

ByteEnumField

0

request_code

ByteEnumField

0

err

BitEnumField (4 bits)

0

nb_items

BitField (12 bits)

0

mbz

BitField (4 bits)

0

data_item_size

BitField (12 bits)

0

req_data

NTPPrivateReqPacketListField (Cond)

[]

data

NTPPrivateRespPacketListField (Cond)

[]

authenticator

PacketField (Cond)

b''

class scapy.layers.ntp.NTPPrivatePktTail

Bases: scapy.packet.Packet

include/ntp_request.h The req_pkt_tail structure is used by ntpd to adjust for different packet sizes that may arrive.

aliastypes
fields_desc
NTPPrivatePktTail fields

tstamp

TimeStampField (64 bits)

0

key_id

IntField

0

dgst

XStrFixedLenField

b''

class scapy.layers.ntp.NTPPrivateReqPacket

Bases: scapy.packet.Packet

Packet handling request data.

aliastypes
fields_desc
NTPPrivateReqPacket fields

req_data

StrField

b''

class scapy.layers.ntp.NTPPrivateReqPacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketListField

Handles specific request packets.

getfield(pkt, s)
m2i(pkt, s)
class scapy.layers.ntp.NTPPrivateRespPacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketListField

PacketListField handling the response data.

getfield(pkt, s)
m2i(pkt, s)
class scapy.layers.ntp.NTPStatusPacket

Bases: scapy.packet.Packet

Packet handling a non specific status word.

aliastypes
extract_padding(s)
fields_desc
NTPStatusPacket fields

status

ShortField

0

class scapy.layers.ntp.NTPSystemStatusPacket

Bases: scapy.packet.Packet

Packet handling the system status fields.

aliastypes
extract_padding(s)
fields_desc
NTPSystemStatusPacket fields

leap_indicator

BitEnumField (2 bits)

0

clock_source

BitEnumField (6 bits)

0

system_event_counter

BitField (4 bits)

0

system_event_code

BitEnumField (4 bits)

0

class scapy.layers.ntp.TimeStampField(name, default)

Bases: scapy.fields.FixedPointField

This field handles the timestamp fields in the NTP header.

any2i(pkt, val)
i2m(pkt, val)
i2repr(pkt, val)
class scapy.layers.ntp.XLEShortField(name, default)

Bases: scapy.fields.LEShortField

XShortField which value is encoded in little endian.

i2repr(pkt, x)