scapy.layers.ntp

NTP (Network Time Protocol). References : RFC 5905, RC 1305, ntpd source code

class scapy.layers.ntp.NTP

Bases: scapy.packet.Packet

Base class that allows easier instantiation of a NTP packet from binary data.

aliastypes

classmethod dispatch_hook(_pkt=None, *args, **kargs)

Returns the right class for the given data.

getlayer(cls, nb=1, _track=None, _subclass=True, **flt)

haslayer(cls)

Specific: NTPHeader().haslayer(NTP) should return True.

mysummary()

pre_dissect(s)

Check that the payload is long enough to build a NTP packet.

class scapy.layers.ntp.NTPAuthenticator

Bases: scapy.packet.Packet

Packet handling the “authenticator” part of a NTP packet, as defined in RFC 5905.

aliastypes

extract_padding(s)

fields_desc

NTPAuthenticator fields

padding	_NTPAuthenticatorPaddingField	b''
key_id	IntField	0
dgst	XStrFixedLenField	b''

class scapy.layers.ntp.NTPClockStatusPacket

Bases: scapy.packet.Packet

Packet handling the clock status fields.

aliastypes

extract_padding(s)

fields_desc

NTPClockStatusPacket fields

clock_status	BitEnumField (8 bits)	0
code	BitField (8 bits)	0

class scapy.layers.ntp.NTPConfPeer

Bases: scapy.packet.Packet

Structure for passing peer configuration information.

aliastypes

fields_desc

NTPConfPeer fields

peeraddr	IPField	'0.0.0.0'
hmode	ByteField	0
version	ByteField	0
minpoll	ByteField	0
maxpoll	ByteField	0
flags	FlagsField (8 bits)	<Flag 0 ()>
ttl	ByteField	0
unused1	ShortField	0
keyid	IntField	0
keystr	StrFixedLenField	b''
v6_flag	IntField	0
unused2	IntField	0
peeraddr6	IP6Field	'::'

class scapy.layers.ntp.NTPConfRestrict

Bases: scapy.packet.Packet

Structure used for specifying restrict entries.

aliastypes

fields_desc

NTPConfRestrict fields

addr	IPField	'0.0.0.0'
mask	IPField	'0.0.0.0'
flags	FlagsField (16 bits)	<Flag 0 ()>
m_flags	ShortField	0
v6_flag	IntField	0
addr6	IP6Field	'::'
mask6	IP6Field	'::'

class scapy.layers.ntp.NTPConfTrap

Bases: scapy.packet.Packet

Structure used to pass add/clear trap information to the client

aliastypes

fields_desc

NTPConfTrap fields

local_address	IPField	'0.0.0.0'
trap_address	IPField	'0.0.0.0'
trap_port	ShortField	0
unused	ShortField	0
v6_flag	IntField	0
local_address6	IP6Field	'::'
trap_address6	IP6Field	'::'

class scapy.layers.ntp.NTPConfUnpeer

Bases: scapy.packet.Packet

Structure for passing peer deletion information.

aliastypes

fields_desc

NTPConfUnpeer fields

peeraddr	IPField	'0.0.0.0'
v6_flag	IntField	0
peeraddr6	IP6Field	'::'

class scapy.layers.ntp.NTPControl

Bases: scapy.layers.ntp.NTP

Packet handling NTP mode 6 / “Control” messages.

aliastypes

fields_desc

NTPControl fields

zeros	BitField (2 bits)	0
version	BitField (3 bits)	2
mode	BitField (3 bits)	6
response	BitField (1 bit)	0
err	BitField (1 bit)	0
more	BitField (1 bit)	0
op_code	BitEnumField (5 bits)	0
sequence	ShortField	0
status_word	NTPControlStatusField (Cond)	b''
status	ShortField (Cond)	0
association_id	ShortField	0
offset	ShortField	0
count	ShortField	None
data	NTPControlDataPacketLenField	b''
authenticator	PacketField	b''

post_build(p, pay)

class scapy.layers.ntp.NTPControlDataPacketLenField(name, default, cls, length_from=None)

Bases: scapy.fields.PacketLenField

PacketField handling the “data” field of NTP control messages.

getfield(pkt, s)

m2i(pkt, m)

class scapy.layers.ntp.NTPControlStatusField(name, default, cls, remain=0)

Bases: scapy.fields.PacketField

This field provides better readability for the “status” field.

m2i(pkt, m)

class scapy.layers.ntp.NTPErrorStatusPacket

Bases: scapy.packet.Packet

Packet handling the error status fields.

aliastypes

extract_padding(s)

fields_desc

NTPErrorStatusPacket fields

error_code	BitEnumField (8 bits)	0
reserved	BitField (8 bits)	0

class scapy.layers.ntp.NTPExtPacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketListField

PacketListField handling NTPv4 extensions (NTPExtension list).

getfield(pkt, s)

m2i(pkt, m)

class scapy.layers.ntp.NTPExtension

Bases: scapy.packet.Packet

Packet handling a NTPv4 extension.

aliastypes

fields_desc

NTPExtension fields

type	ShortField	0
len	ShortField	0
value	PadField	b''

class scapy.layers.ntp.NTPExtensions

Bases: scapy.packet.Packet

Packet handling the NTPv4 extensions and the “MAC part” of the packet.

aliastypes

fields_desc

NTPExtensions fields

extensions	NTPExtPacketListField	[]
mac	PacketField	<NTPAuthenticator  |>

class scapy.layers.ntp.NTPHeader

Bases: scapy.layers.ntp.NTP

Packet handling the RFC 5905 NTP packet.

aliastypes

fields_desc

NTPHeader fields

leap	BitEnumField (2 bits)	0
version	BitField (3 bits)	4
mode	BitEnumField (3 bits)	3
stratum	BitField (8 bits)	2
poll	BitField (8 bits)	10
precision	BitField (8 bits)	0
delay	FixedPointField (32 bits)	0
dispersion	FixedPointField (32 bits)	0
id	IPField (Cond)	'127.0.0.1'
ref_id	StrFixedLenEnumField (Cond)	b''
ref	TimeStampField (64 bits)	0
orig	TimeStampField (64 bits)	None
recv	TimeStampField (64 bits)	0
sent	TimeStampField (64 bits)	None

guess_payload_class(payload)

Handles NTPv4 extensions and MAC part (when authentication is used.)

class scapy.layers.ntp.NTPInfoAuth

Bases: scapy.packet.Packet

Structure used to return information concerning the authentication module.

aliastypes

fields_desc

NTPInfoAuth fields

timereset	IntField	0
numkeys	IntField	0
numfreekeys	IntField	0
keylookups	IntField	0
keynotfound	IntField	0
encryptions	IntField	0
decryptions	IntField	0
expired	IntField	0
keyuncached	IntField	0

class scapy.layers.ntp.NTPInfoControl

Bases: scapy.packet.Packet

Structure used to return statistics from the control module.

aliastypes

fields_desc

NTPInfoControl fields

ctltimereset	IntField	0
numctlreq	IntField	0
numctlbadpkts	IntField	0
numctlresponses	IntField	0
numctlfrags	IntField	0
numctlerrors	IntField	0
numctltooshort	IntField	0
numctlinputresp	IntField	0
numctlinputfrag	IntField	0
numctlinputerr	IntField	0
numctlbadoffset	IntField	0
numctlbadversion	IntField	0
numctldatatooshort	IntField	0
numctlbadop	IntField	0
numasyncmsgs	IntField	0

class scapy.layers.ntp.NTPInfoIOStats

Bases: scapy.packet.Packet

I/O statistics.

aliastypes

fields_desc

NTPInfoIOStats fields

timereset	IntField	0
totalrecvbufs	ShortField	0
freerecvbufs	ShortField	0
fullrecvbufs	ShortField	0
lowwater	ShortField	0
dropped	IntField	0
ignored	IntField	0
received	IntField	0
sent	IntField	0
notsent	IntField	0
interrupts	IntField	0
int_received	IntField	0

class scapy.layers.ntp.NTPInfoIfStatsIPv4

Bases: scapy.packet.Packet

Interface statistics.

aliastypes

fields_desc

NTPInfoIfStatsIPv4 fields

unaddr	PadField	'0.0.0.0'
unbcast	PadField	'0.0.0.0'
unmask	PadField	'0.0.0.0'
v6_flag	IntField	0
ifname	StrFixedLenField	b''
flags	IntField	0
last_ttl	IntField	0
num_mcast	IntField	0
received	IntField	0
sent	IntField	0
notsent	IntField	0
uptime	IntField	0
scopeid	IntField	0
ifindex	IntField	0
ifnum	IntField	0
peercnt	IntField	0
family	ShortField	0
ignore_packets	ByteField	0
action	ByteField	0
_filler0	IntField	0

class scapy.layers.ntp.NTPInfoIfStatsIPv6

Bases: scapy.packet.Packet

Interface statistics.

aliastypes

fields_desc

NTPInfoIfStatsIPv6 fields

unaddr	IP6Field	'::'
unbcast	IP6Field	'::'
unmask	IP6Field	'::'
v6_flag	IntField	0
ifname	StrFixedLenField	b''
flags	IntField	0
last_ttl	IntField	0
num_mcast	IntField	0
received	IntField	0
sent	IntField	0
notsent	IntField	0
uptime	IntField	0
scopeid	IntField	0
ifindex	IntField	0
ifnum	IntField	0
peercnt	IntField	0
family	ShortField	0
ignore_packets	ByteField	0
action	ByteField	0
_filler0	IntField	0

class scapy.layers.ntp.NTPInfoKernel

Bases: scapy.packet.Packet

Structure used for returning kernel pll/PPS information

aliastypes

fields_desc

NTPInfoKernel fields

offset	IntField	0
freq	IntField	0
maxerror	IntField	0
esterror	IntField	0
status	ShortField	0
shift	ShortField	0
constant	IntField	0
precision	IntField	0
tolerance	IntField	0
ppsfreq	IntField	0
jitter	IntField	0
stabil	IntField	0
jitcnt	IntField	0
calcnt	IntField	0
errcnt	IntField	0
stbcnt	IntField	0

class scapy.layers.ntp.NTPInfoLoop

Bases: scapy.packet.Packet

Loop filter variables.

aliastypes

fields_desc

NTPInfoLoop fields

last_offset	TimeStampField (64 bits)	0
drift_comp	TimeStampField (64 bits)	0
compliance	IntField	0
watchdog_timer	IntField	0

class scapy.layers.ntp.NTPInfoMemStats

Bases: scapy.packet.Packet

Peer memory statistics.

aliastypes

fields_desc

NTPInfoMemStats fields

timereset	IntField	0
totalpeermem	ShortField	0
freepeermem	ShortField	0
findpeer_calls	IntField	0
allocations	IntField	0
demobilizations	IntField	0
hashcount	FieldListField	[0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0]

class scapy.layers.ntp.NTPInfoMonitor1

Bases: scapy.packet.Packet

Structure used for returning monitor data.

aliastypes

fields_desc

NTPInfoMonitor1 fields

lasttime	IntField	0
firsttime	IntField	0
lastdrop	IntField	0
count	IntField	0
addr	IPField	'0.0.0.0'
daddr	IPField	'0.0.0.0'
flags	IntField	0
port	ShortField	0
mode	ByteField	0
version	ByteField	0
v6_flag	IntField	0
unused1	IntField	0
addr6	IP6Field	'::'
daddr6	IP6Field	'::'

class scapy.layers.ntp.NTPInfoPeer

Bases: scapy.packet.Packet

Peer information structure.

aliastypes

fields_desc

NTPInfoPeer fields

dstaddr	IPField	'0.0.0.0'
srcaddr	IPField	'0.0.0.0'
srcport	ShortField	0
flags	FlagsField (8 bits)	<Flag 0 ()>
leap	ByteField	0
hmode	ByteEnumField	0
pmode	ByteField	0
stratum	ByteField	0
ppoll	ByteField	0
hpoll	ByteField	0
precision	SignedByteField	0
version	ByteField	0
unused8	ByteField	0
reach	ByteField	0
unreach	ByteField	0
flash	XByteField	0
ttl	ByteField	0
flash2	XLEShortField	0
associd	ShortField	0
keyid	LEIntField	0
pkeyid	IntField	0
refid	IPField	0
timer	IntField	0
rootdelay	FixedPointField (32 bits)	0
rootdispersion	FixedPointField (32 bits)	0
reftime	TimeStampField (64 bits)	0
org	TimeStampField (64 bits)	0
rec	TimeStampField (64 bits)	0
xmt	TimeStampField (64 bits)	0
filtdelay	FieldListField	[0, 0, 0, 0, 0, 0, 0, 0]
filtoffset	FieldListField	[0, 0, 0, 0, 0, 0, 0, 0]
order	FieldListField	[0, 0, 0, 0, 0, 0, 0, 0]
delay	FixedPointField (32 bits)	0
dispersion	FixedPointField (32 bits)	0
offset	TimeStampField (64 bits)	0
selectdisp	FixedPointField (32 bits)	0
unused1	IntField	0
unused2	IntField	0
unused3	IntField	0
unused4	IntField	0
unused5	IntField	0
unused6	IntField	0
unused7	IntField	0
estbdelay	FixedPointField (32 bits)	0
v6_flag	IntField	0
unused9	IntField	0
dstaddr6	IP6Field	'::'
srcaddr6	IP6Field	'::'

class scapy.layers.ntp.NTPInfoPeerList

Bases: scapy.packet.Packet

Used to return raw lists of peers.

aliastypes

fields_desc

NTPInfoPeerList fields

addr	IPField	'0.0.0.0'
port	ShortField	0
hmode	ByteEnumField	0
flags	FlagsField (8 bits)	<Flag 0 ()>
v6_flag	IntField	0
unused1	IntField	0
addr6	IP6Field	'::'

class scapy.layers.ntp.NTPInfoPeerStats

Bases: scapy.packet.Packet

Peer statistics structure.

aliastypes

fields_desc

NTPInfoPeerStats fields

dstaddr	IPField	'0.0.0.0'
srcaddr	IPField	'0.0.0.0'
srcport	ShortField	0
flags	FlagsField (16 bits)	<Flag 0 ()>
timereset	IntField	0
timereceived	IntField	0
timetosend	IntField	0
timereachable	IntField	0
sent	IntField	0
unused1	IntField	0
processed	IntField	0
unused2	IntField	0
badauth	IntField	0
bogusorg	IntField	0
oldpkt	IntField	0
unused3	IntField	0
unused4	IntField	0
seldisp	IntField	0
selbroken	IntField	0
unused5	IntField	0
candidate	ByteField	0
unused6	ByteField	0
unused7	ByteField	0
unused8	ByteField	0
v6_flag	IntField	0
unused9	IntField	0
dstaddr6	IP6Field	'::'
srcaddr6	IP6Field	'::'

class scapy.layers.ntp.NTPInfoPeerSummary

Bases: scapy.packet.Packet

Sort of the info that ntpdc returns by default.

aliastypes

fields_desc

NTPInfoPeerSummary fields

dstaddr	IPField	'0.0.0.0'
srcaddr	IPField	'0.0.0.0'
srcport	ShortField	0
stratum	ByteField	0
hpoll	ByteField	0
ppoll	ByteField	0
reach	ByteField	0
flags	FlagsField (8 bits)	<Flag 0 ()>
hmode	ByteField	{0: 'reserved', 1: 'symmetric active', 2: 'symmetric passive', 3: 'client', 4: 'server', 5: 'broadcast', 6: 'NTP control message', 7: 'reserved for private use'}
delay	FixedPointField (32 bits)	0
offset	TimeStampField (64 bits)	0
dispersion	FixedPointField (32 bits)	0
v6_flag	IntField	0
unused1	IntField	0
dstaddr6	IP6Field	'::'
srcaddr6	IP6Field	'::'

class scapy.layers.ntp.NTPInfoSys

Bases: scapy.packet.Packet

System info. Mostly the sys.* variables, plus a few unique to the implementation.

aliastypes

fields_desc

NTPInfoSys fields

peer	IPField	'0.0.0.0'
peer_mode	ByteField	0
leap	ByteField	0
stratum	ByteField	0
precision	ByteField	0
rootdelay	FixedPointField (32 bits)	0
rootdispersion	FixedPointField (32 bits)	0
refid	IPField	0
reftime	TimeStampField (64 bits)	0
poll	IntField	0
flags	FlagsField (8 bits)	<Flag 0 ()>
unused1	ByteField	0
unused2	ByteField	0
unused3	ByteField	0
bdelay	FixedPointField (32 bits)	0
frequency	FixedPointField (32 bits)	0
authdelay	TimeStampField (64 bits)	0
stability	FixedPointField (32 bits)	0
v6_flag	IntField	0
unused4	IntField	0
peer6	IP6Field	'::'

class scapy.layers.ntp.NTPInfoSysStats

Bases: scapy.packet.Packet

System stats. These are collected in the protocol module.

aliastypes

fields_desc

NTPInfoSysStats fields

timeup	IntField	0
timereset	IntField	0
denied	IntField	0
oldversionpkt	IntField	0
newversionpkt	IntField	0
unknownversion	IntField	0
badlength	IntField	0
processed	IntField	0
badauth	IntField	0
received	IntField	0
limitrejected	IntField	0

class scapy.layers.ntp.NTPInfoTimerStats

Bases: scapy.packet.Packet

Timer stats.

aliastypes

fields_desc

NTPInfoTimerStats fields

timereset	IntField	0
alarms	IntField	0
overflows	IntField	0
xmtcalls	IntField	0

class scapy.layers.ntp.NTPPeerStatusDataPacket

Bases: scapy.packet.Packet

Packet handling the data field when op_code is CTL_OP_READSTAT and the association_id field is null.

aliastypes

fields_desc

NTPPeerStatusDataPacket fields

association_id	ShortField	0
peer_status	PacketField	<NTPPeerStatusPacket  |>

class scapy.layers.ntp.NTPPeerStatusPacket

Bases: scapy.packet.Packet

Packet handling the peer status fields.

aliastypes

extract_padding(s)

fields_desc

NTPPeerStatusPacket fields

configured	BitField (1 bit)	0
auth_enabled	BitField (1 bit)	0
authentic	BitField (1 bit)	0
reachability	BitField (1 bit)	0
reserved	BitField (1 bit)	0
peer_sel	BitEnumField (3 bits)	0
peer_event_counter	BitField (4 bits)	0
peer_event_code	BitEnumField (4 bits)	0

class scapy.layers.ntp.NTPPrivate

Bases: scapy.layers.ntp.NTP

Packet handling the private (mode 7) messages.

aliastypes

fields_desc

NTPPrivate fields

response	BitField (1 bit)	0
more	BitField (1 bit)	0
version	BitField (3 bits)	2
mode	BitField (3 bits)	0
auth	BitField (1 bit)	0
seq	BitField (7 bits)	0
implementation	ByteEnumField	0
request_code	ByteEnumField	0
err	BitEnumField (4 bits)	0
nb_items	BitField (12 bits)	0
mbz	BitField (4 bits)	0
data_item_size	BitField (12 bits)	0
req_data	NTPPrivateReqPacketListField (Cond)	[]
data	NTPPrivateRespPacketListField (Cond)	[]
authenticator	PacketField (Cond)	b''

class scapy.layers.ntp.NTPPrivatePktTail

Bases: scapy.packet.Packet

include/ntp_request.h The req_pkt_tail structure is used by ntpd to adjust for different packet sizes that may arrive.

aliastypes

fields_desc

NTPPrivatePktTail fields

tstamp	TimeStampField (64 bits)	0
key_id	IntField	0
dgst	XStrFixedLenField	b''

class scapy.layers.ntp.NTPPrivateReqPacket

Bases: scapy.packet.Packet

Packet handling request data.

aliastypes

fields_desc

NTPPrivateReqPacket fields

req_data

StrField

b''

class scapy.layers.ntp.NTPPrivateReqPacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketListField

Handles specific request packets.

getfield(pkt, s)

m2i(pkt, s)

class scapy.layers.ntp.NTPPrivateRespPacketListField(name, default, cls=None, count_from=None, length_from=None, next_cls_cb=None)

Bases: scapy.fields.PacketListField

PacketListField handling the response data.

getfield(pkt, s)

m2i(pkt, s)

class scapy.layers.ntp.NTPStatusPacket

Bases: scapy.packet.Packet

Packet handling a non specific status word.

aliastypes

extract_padding(s)

fields_desc

NTPStatusPacket fields

status

ShortField

0

class scapy.layers.ntp.NTPSystemStatusPacket

Bases: scapy.packet.Packet

Packet handling the system status fields.

aliastypes

extract_padding(s)

fields_desc

NTPSystemStatusPacket fields

leap_indicator	BitEnumField (2 bits)	0
clock_source	BitEnumField (6 bits)	0
system_event_counter	BitField (4 bits)	0
system_event_code	BitEnumField (4 bits)	0

class scapy.layers.ntp.TimeStampField(name, default)

Bases: scapy.fields.FixedPointField

This field handles the timestamp fields in the NTP header.

any2i(pkt, val)

i2m(pkt, val)

i2repr(pkt, val)

class scapy.layers.ntp.XLEShortField(name, default)

Bases: scapy.fields.LEShortField

XShortField which value is encoded in little endian.

i2repr(pkt, x)