I am processing (tcpdump) logs from a NTP server. The logs were collected for a day. I am seeing four different types of polling intervals for the clients in these NTP server logs as follows:
I can hypothesize that #1, #2 and #4 are NTP clock sync. algorithm specific. But what about #3? Is it because of configuration? That is, is it the default configuration for many clients? I am looking for a possible explanation for this. Also, any pointers in the NTP doc. would be great too.
From the ntp docs:
minpoll minpoll
maxpoll maxpoll
These options specify the minimum and maximum poll intervals for NTP messages, in seconds as a power of two. The maximum poll interval defaults to 10 (1024 s), but can be increased by the maxpoll option to an upper limit of 17 (36 h). The minimum poll interval defaults to 6 (64 s), but can be decreased by the minpoll option to a lower limit of 3 (8 s).
It's not normal for clients to have a fixed interval (The default config does not set that) but I for example use fixed intervals on certain servers/production machines.
Also keep in mind the comment @dfc made.