adamkadamk

Q: appletimesrv.exe issues steady stream of NTP requests

I'm running Windows 7 Pro SP1 from a Boot Camp partition in Parallels Desktop 8 on OS X 10.9.5 on an iMac (27", Mid-2010).

 

I have observed that within Windows the service AppleTimeSrv.exe issues a steady stream of NTP requests. I have observed the requests using WireShark, and I have confirmed they are coming from AppleTimeSrv.exe because they stop when I stop the service and start up again when I start the service back up.


To be more specific, an NTP packet is sent every 2 seconds to one of the time.apple.com IP addresses. It cycles through all of the time.apple.com addresses (run "nslookup time.apple.com" in a shell to see what they are), pauses 7 seconds, and then starts over again. This never stops.


This is happening despite the fact that in both Windows and OS X, I have the Date and Time settings set to use a different, local time server.

 

This raises a few questions:

Is it normal for AppleTimeSrv.exe to send this many NTP requests, and if so, why?

If it is normal, is it necessary to have AppleTimeSrv.exe running when running from my Boot Camp partition in Parallels (I realize this isn't a strictly Apple software question)?

If it is normal, and it is necessary, is there a way to specify which time server it queries?

 

Additional note: Our organizational firewall may be blocking some or all outgoing NTP requests in an attempt to mitigate NTP DDOS attacks.

 

Thanks.

iMac (27-inch Mid 2010), OS X Mavericks (10.9.5)

Posted on Oct 29, 2014 2:47 PM

Close

Q: appletimesrv.exe issues steady stream of NTP requests

  • All replies
  • Helpful answers

  • by Loner T,

    Loner T Loner T Oct 29, 2014 2:55 PM in response to adamkadamk
    Level 7 (23,813 points)
    Safari
    Oct 29, 2014 2:55 PM in response to adamkadamk

    If you boot directly into Bootcamp Windows (not using Parallels) is it the same behavior?

     

    Parallels modifies the Bootcamp environment to make BIOS level changes so it can boot from the Bootcamp partition.

  • by adamkadamk,

    adamkadamk adamkadamk Oct 29, 2014 10:22 PM in response to Loner T
    Level 1 (0 points)
    Oct 29, 2014 10:22 PM in response to Loner T

    Good question. I haven't booted directly into Windows for 3 years, but I just did it to answer your question, and the answer is, YES, I'm still observing the same constant dribble of NTP packets.

  • by Loner T,

    Loner T Loner T Oct 30, 2014 7:16 AM in response to adamkadamk
    Level 7 (23,813 points)
    Safari
    Oct 30, 2014 7:16 AM in response to adamkadamk

    When you boot directly and set your NTP to a non-Apple server, do you see the same packets?

  • by swordstar,

    swordstar swordstar Feb 25, 2016 5:35 PM in response to adamkadamk
    Level 1 (0 points)
    Feb 25, 2016 5:35 PM in response to adamkadamk

    My network admin was bugging me today on this topic.  After looking at the traffic when booted to just windows or via parallels the traffic is the same.  Too much though as it pings the servers every 4 seconds. 

     

    The fix as I have found is to modify my local machine's hosts file and add entries for the apple time servers which redirects them to our local time server.  The traffic all but stops too.

     

    This was the list of servers I had to modify:

    defra1-ntp-001.aaplimg.com
    ussjc2-ntp-001.aaplimg.com
    usqas2-ntp-001.aaplimg.com
    usnyc3-ntp-001.aaplimg.com
    usatl4-ntp-001.aaplimg.com
    uschi5-ntp-001.aaplimg.com
    uklon5-ntp-001.aaplimg.com
    usmia1-ntp-002.aaplimg.com
    ussjc2-ntp-002.aaplimg.com
    usdal2-ntp-002.aaplimg.com
    usnyc3-ntp-002.aaplimg.com
    usatl4-ntp-002.aaplimg.com
    uschi5-ntp-002.aaplimg.com
    defra1-ntp-003.aaplimg.com
    uslax1-ntp-002.aaplimg.com
    sesto4-ntp-002.aaplimg.com
    nlams2-ntp-002.aaplimg.com
    time.apple.com

     

    And so far so good.