What is NTP?

NTP (Network Time Protocol) is the protocol computers and network devices use to keep their clocks synchronised with accurate time sources over the network.

NTP runs over UDP port 123, and its current version, NTPv4, is defined in RFC 5905. Time sources are arranged in strata. Stratum 0 is a reference clock such as a GPS receiver or atomic clock; a server directly attached to one is stratum 1, a server that syncs from a stratum 1 server is stratum 2, and so on, with 16 meaning "not synchronised". A client exchanges packets carrying timestamps with its servers and uses them to work out both the round-trip delay and how far its own clock is off, then adjusts its clock gradually rather than jumping, so time never runs backwards under normal operation. Querying several servers lets the client discard one that is wrong. Common implementations are chrony and the reference ntpd, and public servers are available through projects such as pool.ntp.org.

For a network engineer, correct time is less about the clock on the wall and more about everything that depends on it. Logs from different routers can only be lined up during an incident if their clocks agree, so remote syslog is close to useless without NTP. Certificate validation needs a sane clock too: TLS, and RPKI validators checking signed objects, will reject valid data if a device thinks it's the wrong year. A common mistake is pointing every device at a single external server; use at least three or four sources, or a couple of internal servers that sync upstream, and permit UDP 123 through the firewall to them. See also RPKI and SNMP. The Operating VyOS lesson sets up remote syslog, where synchronised timestamps matter.