What Is NTP?
Network Time Protocol (NTP) is one of the oldest internet protocols still in widespread use, designed to synchronize clocks across networked computers. First specified by David Mills in 1985, NTP can keep computer clocks accurate to within a few milliseconds over the public internet, and sub-microsecond accuracy on local networks.
The Core Algorithm
NTP works by exchanging timestamps between a client and a server. The client sends a request with its current time (T1), the server records receipt (T2) and sends back a response with T2 and its send time (T3), and the client records receipt (T4). From these four timestamps:
Round-trip delay = (T4 - T1) - (T3 - T2)
Clock offset = ((T2 - T1) + (T3 - T4)) / 2The client uses the offset to adjust its local clock, gradually steering it toward the correct time rather than jumping abruptly (which could break applications).
The Stratum Hierarchy
NTP organizes time sources into a hierarchy called strata:
- Stratum 0: Atomic clocks, GPS receivers, radio clocks — the ultimate time references
- Stratum 1: Servers directly connected to Stratum 0 devices (e.g., time.google.com, time.cloudflare.com)
- Stratum 2: Servers that sync from Stratum 1 — what most organizations use
- Stratum 3–15: Cascading downstream, accuracy decreasing with each hop
Public NTP Servers
time.google.com— Google Public NTP (leap smearing)time.cloudflare.com— Cloudflare NTP (roughtime support)pool.ntp.org— Global volunteer NTP pooltime.windows.com— Microsoft Windows default
Checking NTP Status
# Linux (systemd-timesyncd)
timedatectl status
timedatectl timesync-status
# Linux (ntpd)
ntpq -p
# macOS
sntp -sS time.apple.com
# Windows
w32tm /query /statusNTP vs SNTP
SNTP (Simple NTP) is a simplified version of NTP used by devices that don't need full NTP precision — smartphones, embedded devices, and IoT sensors. It uses the same protocol but implements only a subset of the algorithms, typically achieving accuracy within tens of milliseconds.
Security Considerations
Standard NTP has no authentication, making it vulnerable to man-in-the-middle attacks that can shift a system's clock maliciously. NTPsec and Roughtime are modern alternatives that add cryptographic verification. For critical infrastructure, always use authenticated time sources.