Network time protocol (NTP): de­f­i­n­i­tion and func­tion­al­i­ty

Computer system clocks show users what time it is quickly and con­ve­nient­ly. System time is relevant not only for the user, but also for the computer itself. Time stamps play a crucial role in the com­mu­ni­ca­tion between two or more systems, and also in the correct flow of cross-network processes or services. To prevent system com­pli­ca­tions due to different system times, the so-called network time protocol was published in 1985.

The network time protocol is the result of the de­vel­op­ment work of David L. Mills, a professor at the Uni­ver­si­ty of Delaware. A first official spec­i­fi­ca­tion of the protocol, which is part of the internet protocol family, was published in September 1985 in RFC 958. It describes NTP as a protocol for syn­chro­niz­ing multiple network clocks through a set of spread-out clients and servers. Its pre­de­ces­sors are the time protocol, and ICMP timestamp message, whose functions were combined in the network time protocol. NTP is based on the user datagram protocol (UDP), which enables con­nec­tion­less data transport. The UDP port number for this is 123.

NTP provides the basic protocol mech­a­nisms necessary to syn­chro­nize the time of different systems to an accuracy of one nanosec­ond. It also contains reg­u­la­tions to specify the accuracy and probable sources of error of the local system clock. The protocol only specifies the type of data rep­re­sen­ta­tion and message formats, but doesn’t provide syn­chro­niza­tion and filter al­go­rithms.

To syn­chro­nize the clocks of computers down to a nanosec­ond, the network time protocol uses the co­or­di­nat­ed universal time (UTC), which has been in place since 1972. This is de­ter­mined by various methods, including radio and satellite systems. Important services such as the global po­si­tion­ing system (GPS) are equipped with special receivers to receive the cor­re­spond­ing signals. Since it would neither be cost-effective nor feasible to equip each computer with this kind of receiver, there are so-called primary time servers, which also have a UTC receiver. Using protocols such as NTP, these servers syn­chro­nize the clocks of computers in their network.

In this syn­chro­niza­tion process, there are different hi­er­ar­chi­cal­ly-struc­tured degrees of distance to the UTC source, also known as “strata” (Latin for “layers”). For example, all technical devices that take their time from a primary time server or a satellite nav­i­ga­tion system are clas­si­fied in the stratum-0 category. Examples of this are atomic or radio clocks. A computer that obtains UTC from this kind of atomic or radio clock cor­re­sponds to stratum-1, and so on. Each system is both the client of the preceding stratum and server for systems of the following stratum (at least po­ten­tial­ly).

The basic features of the network time protocol, which is now available in its fourth version (NTPv4), can be sum­ma­rized as follows:

• NTP provides a reference clock that acts as a fixed point for all syn­chro­niza­tion processes. All clocks are co­or­di­nat­ed according to this clock or time. Right from the start, the co­or­di­nat­ed universal time (UTC), which is rec­og­nized as a uniform world time clock, was used for this purpose.
• NTP is a protocol that au­to­mat­i­cal­ly searches for the best time sources for syn­chro­niza­tion. To minimize any error ac­cu­mu­la­tion affecting the syn­chro­niza­tion, several sources can be combined with each other. If possible, the network time protocol rec­og­nizes and ignores time sources that tem­porar­i­ly or per­ma­nent­ly submit strongly deviating values.
• NTP is highly scalable. There may be several reference clocks in each syn­chro­niza­tion network. Fur­ther­more, each network node is able to transmit time in­for­ma­tion in a hi­er­ar­chi­cal structure bidi­rec­tion­al (point-to-point) or uni­di­rec­tion­al (in one direction).
• NTP is very accurate. Thanks to the pos­si­bil­i­ty of selecting the best candidate for syn­chro­niza­tion, a result right up to one nanosec­ond is possible.
• NTP can bridge temporary network con­nec­tion problems: for this purpose, the log uses past readings to determine the current time or de­vi­a­tions.

Orig­i­nal­ly, the network time protocol was developed es­pe­cial­ly for UNIX systems, in which the protocol is still im­ple­ment­ed in the form of the back­ground process ntpd. This serves both as a client that can syn­chro­nize the local system and as an NTP server for other systems. For a long time, this service was also the first choice for im­ple­ment­ing NTP in Linux dis­tri­b­u­tions – newer versions in­creas­ing­ly rely on the client ap­pli­ca­tion timesyncd, which is part of the system manager. MacOS and Windows operating systems now also use the network time protocol to obtain UTC via the internet with simple system processes and without ad­di­tion­al software.

Although NTP is regarded worldwide as the time syn­chro­niza­tion standard, it is not flawless, es­pe­cial­ly in terms of security. For example, because it is based on the con­nec­tion­less UDP protocol, a hacker could send packets to an NTP server with fake sender addresses through IP-spoofing. The address of the targeted system is selected as the sender address. The server sends its response, which is con­sid­er­ably larger than the request sent by the attacker, back to the alleged sender – the targeted system. If the attacker now does this on a large scale by sending a large number of such ma­nip­u­lat­ed requests, he can overload the target system – more on this can be found in the following article: DoS und DDoS.

As a result, several projects have focused on de­vel­op­ing al­ter­na­tive, more secure solutions that can be used in place of the NTP:

• tlsdate: tlsdate was coded by Jacob Appelbaum in 2012, and published on GitHub. Instead of UDP, tlsdate uses the TCP protocol for data transport. The service encrypts the con­nec­tion es­tab­lish­ment via TLS to prevent ma­nip­u­la­tion of the data packets. In addition, tlsdate uses the TLS functions “Server­Hel­lo” and “Clien­tHel­lo” to syn­chro­nize the time. However, the NTP al­ter­na­tive only works with TLS 1.1 and 1.2.
• Ntimed: Ntimed is focused specif­i­cal­ly on security and per­for­mance. For this purpose, the ntpd’s program code, on which Ntimed is based, was optimized. The software package, which consists of client, server, and master files, is available for free on the official Ntimed GitHub directory.
• NTPsec: NTPsec is also a variant of the classic ntpd service. However, over 175,000 lines of code have been stored compared to the original. In addition, the de­vel­op­ment team has replaced a number of unsafe string functions such as “strcpy,” “sprint,” or “gets” with secure coun­ter­parts. These and other dif­fer­ences can be seen in detail on the official website of the open source project.

Apart from the software al­ter­na­tives, the precision time protocol (PTP) also offers an al­ter­na­tive. Unlike the network time protocol, the focus of this network protocol for Linux systems is par­tic­u­lar­ly high syn­chro­niza­tion accuracy. The syn­chro­niza­tion rate with PTP is also down to the nanosec­ond, which even beats the accuracy of NTP. In addition, the protocol requires minimal processor power and network bandwidth, making it ideal for simple, cost-effective devices.

The pool.ntp.org project, initiated by Adrian von Bidder and managed by Ask Bjørn Hansen since July 2005, is a huge virtual cluster of over 4,000 NTP time servers. The majority of the servers dis­trib­uted around the world, which are used by several million systems, are located in Europe. The NTP pool has grown steadily over time due to the project’s community. Anyone who has a server with a static IP address that is per­ma­nent­ly connected to the internet can have it included in the cluster. Despite in­creas­ing demand, the service can be used free of charge and without any re­stric­tions.

If you want to use the NTP server pool to syn­chro­nize your device’s system time, you can do this with UNIX or Linux using the ntpd service. For this, you only need to configure the NTP drift file:

Make sure that the system time is set at least to be roughly accurate. To check the status of the ntpd service, enter the following command after a few minutes:

The NTP client will present a list of the IP addresses from the pool of randomly used time servers. If one of these servers is marked with an asterisk (*), the system time is now syn­chro­nized as required.