What does the '\x1b' + 47 * '\0' m

Question

I am working on an NTP Client. A few other threads indicate that the a message containing "\x1b' + 47 * '\0" is sent to the NTP server, but none of these threads give an explanation about what this message actually means or why it is sent. I've tried looking at the NTP RFC but I was unable to find any information about it in there either.

Answer 1

"\x1b' + 47 * '\0" represents a data field of 48 bytes. 0x1B followed by 47 times 0. 48 bytes is the size of an NTP UDP packet. The first byte (0x1B) specifies LI, VN, and Mode.

RFC 5905 NTP Specification (7.3. Packet Header Variables) specifies the message header as follows:

     0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |LI | VN  |Mode |    Stratum     |     Poll      |  Precision   |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Setting the first byte of the data to 0x1B or 00 011 011 means

LI   = 0    (Leap indicator)
VN   = 3    (Version number)
Mode = 3    (Mode, mode 3 is client mode)

You may also use the more recent version (VN = 4). This would require the first header byte to be set to 0x23 (00 100 011).

The modes are defined as

     +-------+--------------------------+
     | Value | Meaning                  |
     +-------+--------------------------+
     | 0     | reserved                 |
     | 1     | symmetric active         |
     | 2     | symmetric passive        |
     | 3     | client                   |
     | 4     | server                   |
     | 5     | broadcast                |
     | 6     | NTP control message      |
     | 7     | reserved for private use |
     +-------+--------------------------+

Specifying Mode = 3 indicates the message as a client request message.

Sending such a packet to port 123 of an NTP server will force the server to send a reply package.