Ok, I figured it out:  I added the logging switch to the deny jumps in the IPChains rules
and found an approximate port range for the return path.  

> > Does anyone happen to know what the port is?  I know it isn't the
> > "*time*" or "*date*" numbers from /etc/services
> 
> According to RFC 868 (see ftp://ftp.isi.edu/in-notes/rfc868.txt), it's
> port 37, either TCP or UDP.
> 
> > I tried those.
> 
> Check /etc/inetd.conf on the machine that you're trying to get the
> time from.  On my systems, this time server is disabled.
> 
> Also, you should consider using NTP instead.
> 
> Kevin
> 
-- 
Stephen Smith
1955 E. Bluefield Ave.
Phoenix, AZ  85022
(602)971-9520