 | 1 | initial version |
Per https://www.meinbergglobal.com/
the timestamps in NTP is a 32 bit field for seconds so it will wrap at some point in the future.
Using https://www.gasmi.net/hpd/ with a crafted NTP packet reveals that this point is is Feb 7 2036 06:28:16 UTC so the lower hex value is the offset from that vs. 1.1.1900
00 1C 0F 09 00 10 00 1C 0F 5C A2 83 81 00 00 CA 08 00 45 00 00 4C D5 5C 40 00 3B 11 EA 27 0A 50 07 BD 0A 04 64 0C 00 7B 00 7B 00 38 DD 04 1B 02 0F FA 00 00 08 00 00 00 15 3D 0A 04 64 0C 9C 6A 05 00 00 00 00 00 4C B9 48 F7 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 01 00 00 00 00
| | 2 | No.2 Revision |
Per https://www.meinbergglobal.com/
the timestamps in NTP is a 32 bit field for seconds so it will wrap at some point in the future.
Using https://www.gasmi.net/hpd/ with a crafted NTP packet reveals that this point is is Feb 7 2036 06:28:16 UTC so the lower hex value is the offset from that date vs. 1.1.1900
The timestamps you provide don't seem to be real anyways, so this might come from a bogus NTP packet ...
00 1C 0F 09 00 10 00 1C 0F 5C A2 83 81 00 00 CA 08 00 45 00 00 4C D5 5C 40 00 3B 11 EA 27 0A 50 07 BD 0A 04 64 0C 00 7B 00 7B 00 38 DD 04 1B 02 0F FA 00 00 08 00 00 00 15 3D 0A 04 64 0C 9C 6A 05 00 00 00 00 00 4C B9 48 F7 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 01 00 00 00 00
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.