How does NTP decide which server to trust, and why should a device have at least four sources?
Show the answer
Say this first
The client keeps the best recent samples from each server, works out an offset and an error range for each, and looks for the largest group of servers whose ranges overlap. Servers outside that group are falsetickers and are thrown out. The survivors are clustered and combined, and one becomes the system peer. With one source you cannot detect a bad clock, with two you cannot tell which one is wrong, three let a majority outvote one liar, and four still leave three to vote when one fails. The NTP best current practice, RFC 8633, recommends at least four.
Go deeper
The pipeline
- Clock filter: per server, keep the last 8 samples and use the one with the lowest delay. Low delay means the least room for error.
- Selection: an intersection algorithm finds the range most servers agree on. Servers outside it are falsetickers.
- Cluster: prune the survivors that sit furthest from the rest.
- Combine: a weighted average of the survivors. One of them is the system peer.
- Discipline: steer the local clock. ntpd slews offsets below 128 ms and steps larger ones.
Reading it on IOS
R1# show ntp associations
address ref clock st when poll reach delay offset disp
*~10.0.0.123 .GPS. 1 38 64 377 0.412 0.087 0.952
+~10.0.0.124 .GPS. 1 51 64 377 0.530 0.142 1.104
-~192.0.2.123 .PPS. 1 17 64 377 18.230 2.904 3.517
x~198.51.100.123 .GPS. 1 44 64 377 21.904 812.335 2.871
* sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured198.51.100.123 claims stratum 1 yet sits 812 ms away from the other three, so it is marked as a falseticker and ignored. Delay, offset and dispersion are in milliseconds.
reach is an 8-bit register shown in octal: 377 means the last eight polls were all answered.
They will ask next
What does reach 376 tell you?
376 is 11111110 in binary. The newest result shifts in on the right, so the most recent poll got no answer while the seven before it did. A reach of 0 means nothing has come back.
What do ntpd and chrony do with a huge offset at boot?
ntpd refuses to correct an offset over 1000 seconds (the panic threshold) and exits, unless it was started with
-gto allow one large first correction. chrony is told when to step with amakestepline, for examplemakestep 1.0 3: step if the offset is over 1 second during the first three updates.
Traps
- Configuring exactly two NTP servers for redundancy. When they disagree, there is no majority.