Network Time Protocol (NTP) packets may appear on all available networks

When a multiple Network Time Protocol (NTP) client begins to look for a Time service host, it may send NTP packets over an interface with the wrong host address.  The NTP client may send NTP packets from a host address of NIC #1 over NIC #2's subnet.

Note This applies only to multi-homed computers.

The Windows Time Service binds to all available networks when the Windows Server 2003 operating system searches for a time service host.  Upon finding a host, it will stop broadcasting on every network but the one where it found a time service host.

This behavior is by design.

This problem is caused by a combination of following two factors:

• Windows Server 2003 adopted the Weak Host Model that is based on RFC 1122. With this model, in a Multiple-Home Environment, packets that have private source IPs could be sent from a public NIC interface. For more information about the Weak Host Model, visit the following Microsoft Web sites:
  http://support.microsoft.com/default.aspx/kb/175396 (http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fdefault.aspx%2fkb%2f175396)
  http://technet.microsoft.com/en-us/magazine/cc137807.aspx (http://technet.microsoft.com/en-us/magazine/cc137807.aspx)
• Windows Time Service explicitly binds a unique IP address and communicates with servers.

Because of these two factors, the packets that use private IP as the source address can be sent from the public interface when Network Interface Information is updated if Windows Timer Service selects an IP address that is associated with a private interface for the socket source address.

If this problem is encountered, the connection fails. However, immediately after the failure, Win32 Time will change the address bound to the socket and make another connection attempt with this updated IP address. Therefore, as long as the public IP address is available, connections for Windows Time Service will not be interrupted.