Which of the following protocol is used for time synchronization in a system?

NTP is a protocol used to synchronize the clocks of hosts on a network to the UTC time. The precision of NTP can reach 1 ms on a LAN and tens of milliseconds on a WAN.

History of NTP

NTP is one of the earliest standards for clock synchronization on a network. It is designed by David L. Mills — a professor at the University of Delaware, and evolved from the Time Protocol and the ICMP Timestamp message. The following figure shows the evolution of NTP.

NTP Stratum

NTP allows a server to receive accurate UTC time from an authoritative clock source (such as an atomic clock or GPS) and a client to request and receive time from a server.

NTP uses a hierarchical structure of time sources. Each level of this hierarchy is termed a stratum. Generally, an NTP server synchronized to an authoritative clock runs at stratum 1. This NTP server functions as the primary time server to provide clock synchronization for other devices on the network. Stratum 2 servers obtain time from stratum 1 servers, stratum 3 servers obtain time from stratum 2 servers, and so on. The clock stratum ranges from 1 to 16. A smaller value indicates a higher precision. The clocks at stratums 1 to 15 are synchronized. The clocks at stratum 16 are not synchronized and cannot be used.

NTP Implementation

The most typical NTP mode is client/server mode, as shown in the following figure.

1. The client sends an NTP request packet to the server. The packet contains the timestamp t1 when the packet leaves the client.
2. The NTP server receives the NTP request packet at t2, and returns an NTP response packet to the client at t3. This response packet carries timestamps t1, t2, and t3.
3. The client receives the NTP response packet at t4.

The client calculates the following key parameters based on the preceding four timestamps:

• Round-trip delay of NTP packets between the client and the server
  

• Time offset between the client and server

  Calculation formula:

  

  The time offset is calculated as follows:

  

The NTP client adjusts its clock based on the offset value, implementing time synchronization with the NTP server.

NTP

The Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, NTP is one of the oldest Internet protocols in current use.  NTP is intended to synchronize all participating computers to within a few milliseconds of Coordinated Universal Time (UTC).

Why do we need it?

All infrastructure devices such as firewalls, routers, and switches have logs where events of various types are recorded. These logs can contain information valuable for troubleshooting both security and performance of systems. You can direct these event messages to a central server, called a syslog server. By doing so, you create a single system for access to all event logs. A Syslog Server also makes it easier to correlate events on various devices by combining the events into a single log. To ensure proper sequencing of events, all devices should have their time synchronized from a single source using an NTP server.

How does it work?

NTP uses a hierarchical, semi-layered system of time sources. Each level of this hierarchy is termed a stratum and is assigned a number starting with zero for the reference clock at the top. A server synchronized to a stratum n server runs at stratum n + 1. The number represents the distance from the reference clock and is used to prevent cyclical dependencies in the hierarchy. Stratum is not always an indication of quality or reliability; it is common to find stratum 3 time sources that are higher quality than other stratum 2 time sources.

Stratum 0

These are high-precision timekeeping devices such as atomic clocks, GPS or other radio clocks. They generate a very accurate pulse per second signal that triggers an interrupt and timestamp on a connected computer. Stratum 0 devices are also known as reference clocks.

Stratum 1

These are computers whose system time is synchronized to within a few microseconds of their attached stratum 0 devices. Stratum 1 servers may peer with other stratum 1 servers for sanity check and backup. They are also referred to as primary time servers.

Stratum 2

These are computers that are synchronized over a network to stratum 1 servers. Often, a stratum 2 computer will query several stratum 1 servers. Stratum 2 computers may also peer with other stratum 2 computers to provide more stable and robust time for all devices in the peer group.

NTP server misuse and abuse

Because NTP is such a crucial and commonly used protocol, it’s a prime target for attackers. NTP server misuse and abuse cause  damage or degradation to a NTP server.  This is usually either violating the NTP server’s access policy or flooding it with traffic, carrying out a Denial of Service (DoS attack). A denial-of-service attack (DoS attack) is an attack in which the perpetrator floods the targeted machine or resource with unneeded requests in order to overload the systems and prevent all real requests from being fulfilled.

Want to learn more?

Are you looking to up your cybersecurity game and earn your next certification? Or maybe you manage a team that needs a more efficient, effective and less expensive way to train?  Whether you are looking to train your

What protocol is the standard for synchronizing time on the Internet?

What is SNTP used for?

Which of the following is used to synchronize the time on your Linux system with a centralized server?

Which protocol helps synchronize time for routers and switches?