On 12/17/23 19:34, David C. Rankin wrote:

Any idea where that other address comes from?

Guessing, that it is normal NTP traffic going between servers to attempt to determine latency and ensure the servers remain in sync. You must be a? Stratum 3 host? Poke around a bit and see what traffic is used to keep tabs on servers offering NTP. It has been a decade, but I do recall there being a fairly sophisticated way that servers keep metrics on each other.

I'm running Wireshark on my computers. I can see the traffic to both IPv4 and IPv6 addresses of my server. I am also seeing it between my computer and some external server, so I don't think it's traffic between servers.

My servers are stratum 2, so my computer is 3, but it's not being used as a server.