Network Time Protocol
ActiveProtocol for synchronizing clocks of computer systems over packet-switched, variable-latency data networks.
In one line
NTP synchronizes clocks across networks to within milliseconds of UTC. Defined in RFC 5905, it uses a hierarchical stratum model – stratum 0 are atomic clocks, stratum 1 servers connect to them, and clients sync from stratum 2+ servers. NTP operates over UDP port 123 and uses statistical filtering to compensate for variable network latency.
Quick Reference
| Field | Size | Description |
|---|---|---|
| LI | 2 bits | Leap Indicator – warning of impending leap second |
| Version | 3 bits | NTP version number (4) |
| Mode | 3 bits | 3=Client, 4=Server, 5=Broadcast |
| Stratum | 8 bits | Clock stratum (0=unsynchronized, 1=primary, 2-15=secondary) |
| Root Delay | 32 bits | Total roundtrip delay to the reference clock |
| Timestamps | 4×64 bits | Reference, Originate, Receive, Transmit timestamps |
Key Characteristics
Millisecond Accuracy
Achieves 1–50ms accuracy over internet, <1ms on LAN.
Stratum Hierarchy
Reference clocks (stratum 0) → servers → clients cascade.
Statistical Filtering
Uses clock filter to select best of 8 samples.
Drift Correction
Continuously adjusts local clock frequency to minimize drift.
Implementations
Edge cases
- •Stratum 0 devices (atomic clocks, GPS) are never accessed directly by clients.
- •NTP amplification attacks use spoofed UDP requests to overwhelm targets.
- •Large time jumps (>1000 seconds by default) cause ntpd to exit rather than step.
- •Leap seconds require special handling to avoid 1-second errors.
History
NTP was developed by David L. Mills at the University of Delaware, first appearing in RFC 958 (1985). It is one of the oldest internet protocols still in use. SNTP (Simple NTP) is a simplified version for less demanding clients.