Learning Objectives

• Explain why accurate time synchronization is critical for network operations
• Describe the NTP hierarchical stratum model
• Calculate time offset from NTP timestamps
• Understand how NTP handles clock drift and leap seconds

Time Is Everything

When a server logs an error at 14:32:05 and a firewall logs a related event at 14:32:07, you need to know those timestamps are accurate. If one device's clock is off by 30 seconds, correlating logs becomes guesswork. Network Time Protocol (NTP) synchronizes clocks across network devices with millisecond accuracy.

NTP is critical for many network functions: log correlation, certificate validation (TLS checks the current time), authentication protocols (Kerberos is time-sensitive), scheduled tasks, and billing systems. A clock skewed by even a few minutes can break Kerberos authentication or cause TLS certificate errors.

The Stratum Hierarchy

NTP organizes time sources into stratum levels. Stratum 0 is the reference clock itself (atomic clocks, GPS receivers, radio clocks). Stratum 1 servers are directly connected to stratum 0 devices — these are the primary time servers. Stratum 2 servers sync from stratum 1, stratum 3 from stratum 2, and so on down to stratum 15. Stratum 16 is considered unsynchronized.

In practice, most network devices operate at stratum 3 or 4, syncing from a few internal NTP servers that themselves sync from public stratum 1 or 2 servers like time.google.com or pool.ntp.org.

Calculating Time Offset

NTP computes offset using four timestamps: T1 (client send), T2 (server receive), T3 (server send), T4 (client receive). The formula for the time offset (θ) is:

θ = ((T2 - T1) + (T3 - T4)) ÷ 2

This assumes symmetric network delay — the transmit path takes as long as the receive path. NTP also calculates the round-trip delay (δ) as (T4 - T1) - (T3 - T2) to validate against asymmetric paths.

Clock Discipline and Leap Seconds

NTP uses slewing (gradually adjusting the clock by fractions of a second per minute) for small corrections, avoiding sudden time jumps that could disrupt applications. For large offsets (typically >128 ms), NTP steps the clock — a sudden correction. By default, NTP will step time if the offset exceeds 1000 seconds.

Leap seconds are occasionally added to Coordinated Universal Time (UTC) to keep it within 0.9 seconds of astronomical time. NTP handles these through a leap indicator field. A server announces an impending leap second, and clients apply it at the end of the day. The last leap second was added on December 31, 2016.

Key Takeaways

• NTP synchronizes clocks across networks using a hierarchical stratum model (0–15)
• The offset formula θ = ((T2 - T1) + (T3 - T4)) / 2 estimates clock skew
• NTP slews for small corrections (under 128 ms) and steps for large ones
• Accurate time is critical for logs, certificates, authentication, and billing
• Public NTP pools (pool.ntp.org) provide free stratum 1/2 time sources