Any idea why my ROCK is querying NTP (time.nist.gov) every 15 seconds? This is unnecessary and excessive to say the least 
My network works, NTP works so no issues there. Any experiences?
How are you monitoring this? Snort? Wireshark?
Whatever ROCK may or may not be doing with NTP, why is this a concern?
Behavior is confirmed with trace in firewall. Every 15 seconds ROCK is querying DNS for time.nist.gov and right after that it does NTP sync.
This is not a good network behavior, there is absolutely no need to sync clock this often. In fact there’s two separate issues here, first is that apparently ROCK does not have any form of cache for resolved DNS-queries and other one is NTP interval.
Why is this a concern? Practically it may not be, but considering network usage it’s not correct to generate excessive network traffic. Apparently, ROCK needs to check time 4 times a minute to be on top of things?
2 Likes
Odd, according to my Pi-Hole log, my ROCK has queried pool.ntp.org (not the nist domain) just 18 times in the last month. I am using ROCK build 1524 (EA) rather than production, but I doubt that there has been any recent change here.
Does it resolve on your network?
I should have mentioned version, it’s 2.48 (build 1517) production, the OS is version 2.1 (build 271) production.
@mikeb Yes it does, and ROCK is querying NTP and it also receives NTP response correctly.
I have ~80 IP-addresses in my network, ROCK is responsible for 9.5% of DNS-queries alone