Skip to main content

What is NTP? A Guide About Network Time Protocol

importance of NTP

Figure 1. Importance of NTP

Time synchronization is crucial in present computer networks because methods like managing, securing, planning, and debugging a network require correct time to determine when an event occurred. Maintaining an exact time is challenging since the computer's clock drifts by a few minutes or seconds every day. The Network Time Protocol (NTP) is a widely used time synchronization protocol, and many individuals use NTP software to synchronize their devices with NTP servers to fix their time synchronization issues. NTP is used by servers, switches, routers and computers to synchronize their time over a network. It enables these devices to keep precise time by syncing their clocks with an external time source on a regular basis.

Time synchronization makes a significant contribution to distributed systems and is a critical feature of any infrastructure. In addition, time correlation is critical for a variety of tasks such as system authentication, network usage analysis, file system updates, problem diagnosis, security rule implementation, and more. Every computer contains a hardware clock that maintains track of the current time, although it is inaccurate due to clock frequency drift. A little change in temperature has an impact on the clocks, as do crystal oscillators. As a result, the clocks of the two computers will not be the same. According to Ganeriwal’s research, a computer can deviate up to 40 microseconds per second. Time synchronization between devices is critical to keeping track of time accurately.

What is NTP?

The network time protocol (NTP) is the most often used network clock synchronization protocol in software synchronization, and it is well suited to large networks. High precision time is one of the most important business requirements as well as an important challenge. The Network time protocol (NTP) is a time synchronization protocol that is used to deal with the issue of high precision. It is a protocol that is used to synchronize the time of a computer that is located in a different geographical location on the internet in order to keep the same time.

NTP is more than a protocol; it is an integrated technology that enables the systematic broadcast of national standard time through the Internet and connected private and business networks. The technology is widespread, omnipresent, and uncontrolled by commercial interests. NTP's ultimate goal is to synchronize all participating computers' clocks within a millisecond or two of UTC. It has high accuracy and stability.

NTP History

Research into timekeeping with the network precedes NTP. J. Postel and H. Harrenstein issued a two-page RFC titled the "Time Protocol" in May 1983, which may feel like an eternity in the networking industry. RFC 868 defined a very basic time protocol that could be used as a service over UDP or TCP. NTP was developed at the University of Delaware in 1985. Dave Mills published RFC 958, the first in a series of RFCs that specify the Network Time Protocol, two years after RFC 868 was published. Since then, efforts have been made to improve NTP and make it more useful and relevant in the fast-changing networking environment.

What Does NTP Do?

With the rapid development of computer technology, accurate time synchronization is required in all fields, And there are three time synchronization methods:

  1. Hardware synchronization
  2. Navigation satellite time synchronization
  3. Software synchronization

The most common technique of time synchronization is software synchronization, which employs network time synchronization and a clock synchronization algorithm to synchronize time in a global network. The NTP is the most often used network clock synchronization protocol in software synchronization, and it is well suited to large networks.

Every networking device does not require NTP settings in order to function. Every router or switch has its own internal clock, which network administrators can set to the time on their watches at the time of configuration. A household with many clocks, each indicating a different time, may work fine until an incident occurs that demands an accurate time identification. If the victim links an act of vandalism, or worse, to an inaccurate time of day or night (an earlier or later time than the actual time at the location of the act), and the suspect can produce an alibi of being somewhere else at the reported time, the case may collapse because there is no other hard evidence linking the suspect to the crime.

The same concept applies to networking and time synchronization over the network. Every router, switch, the server or workstation can have its own time until situations arise where the exact time must be known. As a result, on a complex network with hundreds of time-dependent devices, time synchronization and accurate timekeeping become critical components of overall network operations and management. When network operation is subject to the unfavorable effects of cascading events caused by either an overt initial occurrence (such as a security breach) or the mistake of an event that is supposed to initiate a sequence of desirable actions, being able to reconstruct events correctly in time gives an administrator a better chance of implementing effective corrective actions.

How NTP Works?

The Network Time Protocol (NTP) is comprised of three components:

  • The NTP software program, known as a daemon in Unix and a service in Windows;
  • The protocol that exchanges time values between servers and clients;
  • A set of algorithms that process the time values to advance or retard the system clock.

The terms "server" and "client" are used in NTP. A client is a system that is seeking to synchronize its clock with a server, while a server is a source of time information. A primary server or a secondary server are the two types of servers. A main server (also known as a stratum 1 server in relation to the telephone network's time reference architecture) is a server that receives a UTC time signal directly from an authoritative clock source, such as a programmed atomic clock or more typically these days, a GPS signal source. The time signal is received by a secondary server from one or more upstream servers, and it is distributed to one or more downstream servers and clients. Secondary servers function as clock signal repeaters, relieving the primary servers of client query demand while still providing a clock signal of equivalent quality to the primary servers. The secondary servers must be organized in a strict upstream and downstream hierarchy, and stratum terminology is frequently used to help with this.

How NTP works

Figure 2. How NTP works

A stratum 1 server gets its time signal from a UTC reference source, as previously stated. The time signal for a stratum 2 server comes from a stratum 1 server, for a stratum 3 server from stratum 2 servers, and so on.

In order to maintain a reference clock signal, a stratum n server can peer with numerous stratum n-1 servers. This stratum architecture is designed to prevent synchronization loops between time servers. Clients communicate with servers to sync their internal clocks with the NTP time signal.

The NTP protocol is essentially a clock request transaction in which a client requests the current time from a server while passing its own time with the request. The server adds its time to the data packet and returns it to the client. When the client receives the packet, it may extract two critical pieces of information: the server's reference time and the elapsed time for a signal to move from the client to the server and back, as measured by the local clock. Repeated iterations of this procedure enable the local client to eliminate the effects of network jitter and thus obtain a stable value for the delay between the local clock and the server's reference clock standard. This value is then used to adjust the local clock so that it is in sync with the server.

In order to access time keeping with high precision, a free-of-charge project was launched. It's named “The NTP pool Project”. The project connects very large virtual clusters of NTP servers to the Internet. Individuals or businesses with internet-connected servers volunteer and make available the time servers that comprise the pools. Pools of servers are located in almost every country on the planet. This enables clients to use a nearby server, reducing round-trip delays and improving integrity. You can just configure in the domain name "pool.ntp.org" to tell the pool system to look for the nearest accessible server to your location.

What are the Features of NTP?

The followings are the basic features of the network time protocol:

  • NTP provides a reference clock that provides a source of reference for all synchronization tasks. All clocks are arranged according to this clock or time. The coordinated universal time (UTC), which is regarded as a standard world time clock, has been used for this purpose from the beginning.
  • NTP is a synchronization protocol that searches for the best time sources automatically. Several sources can be merged to reduce the amount of error buildup that affects synchronization. If possible, the network time protocol recognizes and dismisses time sources that submit strongly deviating values on a temporary or permanent basis.
  • NTP is a very scalable protocol. Each synchronization network may have many reference clocks. Furthermore, each network node can send bidirectional (point-to-point) or unidirectional time information in a hierarchical structure (in one direction).
  • NTP is quite reliable. A result of up to one nanosecond is feasible thanks to the ability to choose the best candidate for synchronization.
  • NTP can be used to solve temporary network connection issues, It uses past readings to determine the time or variance at this moment in time.

What is NTP Configuration?

Choosing your time source, deciding on the NTP topology, identifying which NTP features to configure, and monitoring and controlling NTP operations are all part of the process of designing an effective NTP implementation. Each phase provides a number of options, all of which are based on the network users’ requirement for precise and synchronized network time. Depending on whether you're configuring a server, client, or peer, the basic NTP settings will differ. Variation will also occur as a result of the operating system. The basic configuration, meanwhile, allows a client to receive updates from a server, a server to offer updates, and peers to exchange updates. NTP security and redundancy are not addressed by basic NTP configuration.

How to change NTP Configuration?

If you want to set up NTP, you'll need access to at least one NTP-enabled server. The NTP daemon gets its settings from a file called “ntp.conf” or “xntp.conf”. This file is usually found in the /etc directory on UNIX-like systems. If a recent NTP version is installed on Windows, the ntp.conf file is located in an etc directory below the NTP program directory.

An example of a basic ntp.conf file would look like:

--- GENERAL CONFIGURATION ---

server aaa.bbb.ccc.ddd

server 127.127.1.0

fudge 127.127.1.0 stratum 10

---Drift file. -----

driftfile /etc/ntp/drift

The most basic ntp.conf file will simply list two servers, one with which it wishes to synchronize and one with which it wishes to communicate via a pseudo IP address (in this case 127.127.1.0). In the event of a network outage or the failure of the remote NTP server, the pseudo IP address is used. NTP will synchronize with itself until it can resume synchronization with the remote server. It is recommended that you list at least two remote servers against which you can synchronize. One will serve as the primary server, while the other will serve as a backup. You should also specify where a drift file should be saved. NTP will "learn" the system clock's error rate over time and adjust for it automatically.

What is Local NTP?

To synchronize time among devices, most devices use an internet time server and a clock source, such as a GPS satellite. Time synchronization must be achieved using a local Network Time Protocol (NTP) server in an offline scenario, where devices are not connected to the internet.

A designer might think about utilizing and configuring an existing network device as a local NTP "master" when picking an NTP time source. A local NTP "master" uses a time source that is not synced with UTC (time determined and set by you). The "master" feature allows for time synchronization across participating devices based on local time, even if that time is not very accurate in comparison to UTC. A router, switch, or server that implements the "master" capability can act as a local NTP "master." Given that the primary purpose of a local NTP "master" is not time synchronization, consider using the "master" feature as a free option, similar to using public NTP servers available over the Internet.

What is NTP Server?

The network time server is a general term used to describe the software operating on the NTP-Network Time Protocol server, which can be installed on any server/computer platform that supports NTP. Network devices (tray mount, rack, etc.) acquire and utilise time from an external source in order to maintain time within their own internal clocks, and then deliver the time to their associated networks. NTP servers listen for client NTP packets on port 123. The NTP server is stateless, responding to each received client NTP packet in a transactional manner by adding information such as timestamps to the received packet and returning it to the original sender, with no regard for previous NTP transactions.

What is NTP Server Used for?

An NTP server is a time source, while an NTP client is a system or device that tries to synchronize its clock with a server. Servers can be primary or secondary. A primary server gets UTC time signals from a highly precise source, such as an atomic clock or, more typically, a GPS signal source. A secondary server receives its time signal from one or more upstream servers and sends it to one or more downstream servers and clients. Secondary servers are arranged in a strict hierarchy in terms of upstream and downstream, and stratum terminology is frequently used to help with this process.

How to Learn NTP Server IP?

How to learn the IP of the NTP server in both Windows and Linux is explained below.

To Learn NTP Server IP on Windows:

Before you can sync your PC time with your NTP server, you must first start the Windows time service.

Step 1: Open the Command prompt and run as an Administrator. Then enter the following command to register successfully time service.

w32tm /register

Step 2: Again in command prompt, run the following command to start time service.

sc start w32time

Step 3: After register and running time server, we can get learn server ip adress from the following command. In command prompt, run the following command to learn information about NTP server ip adress.

w32tm /query /status

To Learn NTP Server IP on Linux:

To identify the exact upstream IP address of the ntp server on a Linux system; you should type the following command on CLI.

systemctl status systemd-timesyncd

How many NTP servers are available on the internet?

As of today, according to Project Sonar, there is 1,638,577 NTP servers on the public internet and their numbers are increasing day by day.

Which version of NTP is Better?

The synchronization of all network components is critical for achieving high service efficiency and avoiding problems. There are different time synchronization protocols that are based on NTP protocols but are customized according to needs.

  • The Simple Network Time Protocol (SNTP)
  • Network Time Protocol (NTP)
  • Precision Time Protocol (PTP)

are the three most popular synchronization technologies.

The PTP protocol is the most accurate, with nanosecond accuracy, while the SNTP and NTP protocols are less accurate, with microsecond accuracy, but are satisfactory for certain industrial and commercial needs.

In order for our equipment to perform effectively, we must identify its specific requirements. The more the time precision required, the more sophisticated and precise the equipment's work must be. In this case, the PTP algorithm's implementation will be more appropriate.

The use of NTP and SNTP protocols is appropriate if our devices do not require high accuracy. The device's position in the network, memory capacity, and demand for accuracy will all affect which of these two methods is used. SNTP has a simpler algorithm than NTP. So it consumes less system resources. SNTP may be preferred more in systems that do not require very high level security.

What is NTP in Cyber Security?

Performing safe time synchronization over a public network is both appealing and risky. Obviously, catastrophic things can happen if a terrorist manipulates time, causing trains to collide, stocks to be sold before they are purchased, and the evening news to be shown at midnight. If time is distorted enough to invalidate prescriptions, disk quotas, or income tax filings, there is a more evil aspect as well.

The Network Time Protocol (NTP) allows any machine to query one of these time servers over the Internet to synchronize its internal clock with UTC. However, in order for the organization's systems to sync, it must basically leave a door open in its firewall for time information to enter. NTP is designed to use a certain port on 123. From a security point of view, this is a major risk. Many firms utilize this strategy to maintain network time. On the other hand nefarious hackers also know exactly which door on the firewall will be open. It's similar to sending an attacker an invitation with instructions on how to hack your network.

Intruders can use NTP to choke the network with large response packets, impair a time-sensitive important service, and so on. NTP is vulnerable to a number of different sorts of attacks. The following are a few of them:

  • A replay attack
  • Man in the middle attack (MITM)
  • A delay attack in which client and server packets are delayed for a fixed or variable amount of time but remain unmodified.
  • A DDoS attack in which an attacker identifies an unprotected machine, turns it into a bot master, and uses it to infect additional vulnerable computers with malware.

NTP is one of the internet's oldest protocols, and it's not secure by default, making it vulnerable to DDoS and man-in-the-middle (MitM) attempts. NTP Amplification is a sort of reflected DDoS attack in which an attacker repeatedly sends queries to publicly accessible NTP servers using a fake IP address in order to deliver the targeted system a huge response from the NTP server. Due to the increased demand for bandwidth, this might cause service degradation, preventing legitimate users and systems from accessing and utilising network resources.

What is SNTP?

To improve the accuracy of clock synchronization and prevent clock drift, NTP has developed complex statistical methods. On the other hand, algorithms use a lot of memory and processing power. NTP's maximum performance isn't required for many applications, especially on smaller systems. As a result, the Simple Network Time Protocol (SNTP) was created to enable clock synchronization for less capable systems that do not require the sophistication of NTP.

The Simple Network Time Protocol (SNTP) is a client-only version of the Network Time Protocol (NTP). SNTP can only receive time from NTP servers and cannot provide time services to other systems. SNTP lacks the sophisticated mathematical formulas that NTP uses to determine the most precise server. It also lacks the algorithms to shift time and avoid sudden time shifts, instead opting for a phased approach to time alterations. As a result, SNTP is appropriate for applications where precision isn't required. As a reason, SNTP should not be used to provide services to clients. It should be used exclusively at the top and bottom of the NTP hierarchy.

What are the Differences Between NTP and SNTP?

The primary differences between NTP and SNTP are explained below.

  • To obtain a very high degree of clock synchronization, NTP has developed complex statistical algorithms with calibration approaches targeted at filtering tiny deviations. In contrast, SNTP takes a considerably more straightforward method to network time synchronization. Many of the NTP algorithms' complexities have been removed or simplified.
  • Multiple time references are regularly monitored to ensure redundancy. The most reliable and stable are determined by complex selection algorithms. Multiple time sources, including a combination of hardware clocks and network time sources, can be monitored to improve reliability. On the other hand, SNTP is unable to monitor and filter numerous time references. In most cases, the protocol can only be set up to work with a single time source.
  • NTP has a variety of security features. Symmetric Key Cryptography is used to achieve secure client-server authentication. On the contrary, many SNTP clients do not use secure authentication procedures for the sake of simplicity, leaving systems exposed to malicious users.

What is PTP?

PTP (Precision Time Protocol) is completely defined in IEEE standard 1588. It's a very accurate and scalable time source that can support a wide range of networked equipment. It was created for systems that require the highest level of precision. PTP can enable time stamping to the level of tens of nanoseconds by enabling hardware time stamping and using it in conjunction with specified hardware setups. It works on a master-slave architecture and uses a Grand Master clock to synchronize communication. PTP is mainly utilized in military applications, the electric sector, high-level research institutes (such as CERN), telecommunications, and the financial services industry as a time distribution protocol that offers the maximum level of precision without the inherent weaknesses of GPS.

What is the Difference Between PTP and NTP?

The primary differences between PTP and NTP are explained below.

  • PTP was created for usage across a LAN, or more particularly, "spatially localized systems with larger system options". In contrast, NTP is commonly utilized across the Internet, and as a result, it is prone to a lot of nondeterministic delays from intermediary network nodes, as well as a lot of security concerns.
  • PTP stands for "administrative-free operation," which means that the devices that make up a system can be installed with little or no configuration and yet achieve the best time synchronization for the environment. However, the optimization algorithm used by NTP does not provide for the same level of autonomy.
  • NTP provides millisecond accuracy, whereas PTP provides sub-microsecond accuracy.
  • NTP outlines the usage of access-control lists and a type of public-key cryptography called Autokey, whereas PTP simply contains an experimental addition to the protocol to address security breaches.