NTP

Why it exists

Certificates, logs, and replay windows all assume clocks agree. Wrong time looks like a crypto or AAA failure.

Point clients at authenticated NTP servers with a local calendar fallback.

Client associates and disciplines

A client reaches a stratum-2 server, selects it, and slews toward the server offset.

How it works

Clients associate with servers; stratum counts hops from a reference clock. The discipline algorithm slews or steps. Authentication is optional but operationally important.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. Certificates rejected on an otherwise healthy PKI.

   Narrow it down

   1. show clock
   2. NTP associations

   Cause

   Local clock far from real time.

   Fix

   Sync NTP before chasing CA config.

2. Persistent offset that never settles.

   Narrow it down

   1. Compare forward/reverse delay
   2. Traceroute both ways

   Cause

   Path asymmetry.

   Fix

   Fix routing or relocate the server.

3. Association never reaches sync.

   Narrow it down

   1. ACL/UDP 123
   2. Server reach bits

   Cause

   Filtered or unreachable server.

   Fix

   Open UDP/123 and verify reachability.

4. Two NTP servers fight.

   Narrow it down

   1. Selection scores
   2. Authentication

   Cause

   Inconsistent servers or auth failure.

   Fix

   Prefer a coherent set; enable auth.

5. Logs out of order across devices.

   Narrow it down

   1. Compare clocks
   2. Confirm the related configuration and counters.

   Cause

   Mixed synced and free-running nodes.

   Fix

   Make NTP mandatory in the build.

Design notes

Point clients at authenticated NTP servers with a local calendar fallback.

Misconceptions

“NTP steps the clock on every poll.”

Small offsets are usually slewed; steps are for large errors and are operationally disruptive.

“Stratum 1 is “more accurate” than a well-synced stratum 2.”

Stratum counts hops from a reference clock, not a precision guarantee by itself.

“TLS failures are never a time problem.”

notYetValid/expired often means the box clock, not the CA.

More walkthroughs

Check yourself

• Stratum primarily measures:

  • CPU load
  • Hops from a reference clock
  • Packet loss
  • BGP AS distance
• Year-off clocks often surface as:

  • STP loops
  • TLS certificate time failures
  • OSPF MTU issues
  • LACP suspends
• For small offsets NTP usually:

  • Reboots
  • Slews the clock
  • Disables interfaces
  • Clears BGP
• Persistent path asymmetry makes NTP:

  • More accurate
  • Report offset that mixes delay asymmetry with clock error
  • Ignore delay
  • Switch to PTP automatically
• NTP uses:

  • TCP 123
  • UDP 123
  • TCP 323
  • UDP 514
• Unauthenticated NTP risk is:

  • None on LANs
  • Accepting false time from an attacker
  • Only cosmetic
  • Limited to stratum 15
• Large error steps are:

  • Always preferred
  • Operationally disruptive and used when slew is insufficient
  • Required every poll
  • Identical to PTP follow-up
• Client mode packets are mode:

  • 1
  • 3
  • 5
  • 7

Related

• PTP

  Sub-microsecond timing with Announce election and Delay_Req/Resp — not a drop-in replacement for NTP on every campus.

• TLS

  Authenticates a server and encrypts a byte stream in one round trip — and hides less than people assume, because the parts a middlebox used to read had to stay readable.