Summary

  • NTP does not obtain truth from a single reply. It estimates offset and round-trip delay from four timestamps, filters repeated observations, rejects inconsistent sources when enough agreement exists, and disciplines the client's own clock.
  • Its strata describe distance from a reference clock and help prevent timing loops. They are not certificates of accuracy, ownership or institutional rank, and several servers can still share one hidden failure.
  • Later authentication can protect a client/server exchange, but it cannot make an incorrect upstream clock correct. Diversity, permission, monitoring and the final clock policy remain operator decisions.

An Internet full of confident, incorrect clocks

David Mills's 1989 report began with an awkward result. A survey sent three time-protocol queries toward 94,260 hosts and gateways. Of the 20,758 that replied, roughly half reported time more than two minutes away from the survey's reference. About one in ten missed by more than four hours. A few were more than two weeks wrong.

Those numbers were not a census of every connected machine. They described the reachable respondents under one experiment. Even with that limit, they demolished a tempting assumption: connectivity does not turn clocks into witnesses. A machine may answer promptly and consistently while its oscillator drifts, its timezone is misapplied, its upstream source fails or its operator never notices.

The Network Time Protocol grew around that distrust. Its achievement was not to nominate a more persuasive clock. It made disagreement measurable, gave clients a method for excluding implausible sources, and left the last act—changing the local clock—inside the machine that would live with the consequences.

Before NTP, four moments around one uncertain journey

The design had a visible ancestor in the 1981 DCNET Internet Clock Service. RFC 778 described clocks of unequal quality: a radio-linked source receiving WWV at COMSAT and power-line clocks subject to offset and drift. ICMP timestamp messages let two cooperating hosts record moments around a request and return.

That exchange introduced the geometry that NTP would refine. In modern notation, the client transmits at t1; the server receives at t2; the server transmits at t3; the client receives at t4. From those four readings, NTP estimates the client's offset from the server as half of [(t2 - t1) + (t3 - t4)]. It estimates round-trip network delay as (t4 - t1) - (t3 - t2).

The equations do not stop the network clock. They subtract the server's processing interval and use the two directions to make a practical offset estimate. If outward and return delays differ materially, that asymmetry becomes clock error. No packet reveals both one-way delays independently. NTP therefore begins with an estimate whose uncertainty cannot be argued away by precision in the timestamp format.

A protocol that could lose a packet and continue

RFC 958 specified NTP in September 1985. RFC 1059's Version 1 description followed in 1988 after approximately two years of prototype operation. Mills presented a distributed subnet of time servers, multiple primary reference sources and hierarchical paths outward to secondary servers. The architecture did not require a global election that crowned one master for the Internet.

Nor did it require reliable delivery. A time datagram that vanished did not have to be recovered in sequence; another measurement could replace it. This “returnable-time” style suited a multigateway Internet in which paths delayed, reordered or dropped packets. The protocol's state came from a stream of observations, not the sanctity of one transaction.

Version 1 already had to do more than exchange timestamps. It filtered samples, suppressed glitches, compensated for oscillator drift and slewed clock offset rather than treating every new value as an order to jump. RFC 1059 reported tens-of-milliseconds results for the prototype environment. That is evidence about those tests, not a timeless guarantee for every path, clock and implementation.

The historical movement matters. NTP did not first solve perfect time distribution and later add robustness. The unreliable network and the unruly local oscillator were the original material of the design.

From samples to a clock worth following

Each configured source produces a sequence of offset and delay estimates. A clock filter favours useful recent samples, particularly those with lower apparent delay, because queueing can inflate a measurement but cannot make the physical path faster than its best observed case. Sudden excursions can be treated as noise rather than commands.

The harder problem begins when sources disagree. NTP represents each candidate with an interval that includes its estimated uncertainty. The clock-selection procedure looks for a defensible intersection and marks candidates outside it as falsetickers. Version 3, documented in RFC 1305, refined these error bounds and selection algorithms. Version 4 describes later stages that cluster the surviving candidates and combine their offsets into a system estimate.

This is not majority magic. The University of Delaware algorithm description is explicit about a case in which no adequate intersection exists: selection can fail. It is better for a client to declare itself unsynchronised than to disguise unresolved disagreement as accuracy.

An apparent majority can also be correlated. Five hostnames may trace back to the same GPS receiver, the same virtualisation host, the same operator error or the same leap-smear policy. NTP can compare the observations it receives; it cannot discover every hidden administrative or physical dependency from timestamp arithmetic alone.

The ladder that is not a throne

Stratum is the field most likely to be turned into a misleading social metaphor. Under NTPv4, a stratum-1 server is directly associated with a primary reference clock. Strata 2 through 15 describe successive synchronisation distance. Stratum 16 means the source is unsynchronised.

This ladder helps stop loops. A server should not derive time from a descendant and circulate an error indefinitely. Greater reference distance also tends to add uncertainty. But a low number does not certify a well-operated service. A congested or faulty stratum-1 server can be a worse source than a stable stratum-2 or stratum-3 server with good path measurements.

Stratum therefore says nothing about corporate ownership, public mandate or the right to set another organisation's clocks. NTP retains primary sources and hierarchical distribution, but its hierarchy is not one sovereign tree. Client/server, broadcast and symmetric modes coexist. Symmetric peers can exchange time in both directions, and clients can choose several administratively distinct sources.

The protocol's constitutional choice was not to abolish hierarchy. It was to prevent reference distance from automatically becoming unquestionable authority.

The operator remains inside the loop

Later best practice makes the unfinished work visible. RFC 8633 recommends multiple, genuinely diverse sources; four or more can improve tolerance when their failures are independent. It also asks operators to monitor those sources. A server that was sensible when configured can change ownership, ancestry, leap policy or quality.

Diversity is partly technical and partly institutional. Sources in different autonomous systems may still share a reference clock. Sources under different names may be one anycast service. Mixing leap-smeared time with unsmeared UTC can make healthy clocks appear to be falsetickers during a leap event. A client needs to know not only how many replies arrived, but what dependencies and time scales they represent.

Permission is another part of correctness. Public reachability is not an unlimited licence. RFC 8633 warns vendors against hardcoding third-party public servers into embedded products without agreement. A default written once can send traffic for the lifetime of millions of devices, leaving the server operator to fund and defend a dependency it never accepted. NTP's UDP service and management interfaces also require rate controls and exposure decisions because they have been abused for amplification.

These duties cannot be delegated to an offset equation. The protocol supplies evidence; an operator chooses the witnesses and bears the cost of the choice.

Authentication without a ministry of time

Network Time Security, standardised in RFC 8915 in 2020, protects NTP client/server mode. A TLS-based key-establishment exchange gives the client key material and protected cookies. Subsequent NTP packets use authenticated extension fields, while the time server can remain stateless after the setup because the client carries the cookies.

NTS answers important questions: did this response come from the expected server, and was it altered in transit? It does not answer whether the server's reference clock is correct, whether its upstream sources are independent or whether its leap policy matches the client's needs. An authenticated mistake is still a mistake delivered with integrity.

The scope is also precise. RFC 8915 does not secure NTP symmetric or control modes. Treating “NTS enabled” as a universal security seal would erase the very boundaries the specification preserved.

Shared time as revisable evidence

Clocks now order logs, certificate validity, database writes, market events and industrial actions. A large error can make a correct security credential appear expired, reverse the apparent order of incidents or fracture a distributed system. That importance creates pressure to find one service whose brand can stand in for certainty.

NTP offers a better, less comforting settlement. A client records fallible statements. It discounts noisy journeys, compares sources, rejects some, combines others and continuously disciplines an imperfect local oscillator. When the evidence no longer overlaps, it can say that time is unknown instead of laundering conflict into a precise display.

No participant becomes unnecessary. Reference-clock operators maintain their link to civil time. Server operators manage ancestry and access. Networks shape delay. Clients choose sources and decide how the clock may move. Protocol designers make those relationships measurable without granting any one of them ownership of time.

The clock built from disagreement is not independent of trust. Its trust is plural, observed and defeasible. That is how NTP made a common time service possible without requiring every connected machine to surrender its clock to one permanent master.

Sources and evidence limits

The pre-NTP timestamp exchange is documented in RFC 778. The first NTP specification is RFC 958, and the Version 1 architecture and prototype claims are in RFC 1059. The 1989 survey appears in RFC 1129.

Version 3 filtering and selection are documented in RFC 1305. The current four-timestamp model, strata, modes and later selection pipeline are specified in RFC 5905, supplemented by the University of Delaware's Clock Select Algorithm. Operational guidance comes from RFC 8633, and NTS's client/server security scope from RFC 8915.

The RFC 1129 figures cover responding systems in that survey, not every Internet host. Protocol versions changed across these documents. Later requirements and algorithms are used to explain the mature control surface, not attributed to the 1985 implementation.