What is an NTP stratum, and why does accurate time matter on a network?
Show the answer
Say this first
Stratum is the distance from a reference clock. Stratum 0 is the reference itself (GPS, an atomic clock), stratum 1 is a server attached to it, and each NTP hop adds one, up to 15. Stratum 16 means unsynchronized. Time matters because so much depends on it: lining up logs from many devices, certificate validity for VPNs, 802.1X and HTTPS, Kerberos (Active Directory rejects more than 5 minutes of skew by default), one-time passwords, and evidence that holds up after an incident.
Go deeper
How NTP works
NTP runs on UDP 123 (NTPv4 is RFC 5905). The client stamps four times per exchange:
| Stamp | Taken when |
|---|---|
| T1 | client sends the request |
| T2 | server receives it |
| T3 | server sends the reply |
| T4 | client receives the reply |
Round-trip delay is (T4 - T1) - (T3 - T2) and the clock offset is ((T2 - T1) + (T3 - T4)) / 2.
The formula assumes the path is symmetric, so asymmetric paths show up as offset error. Small errors
are slewed (the clock is sped up or slowed down), large ones are stepped. IOS polls between 64 and 1024
seconds by default.
A sensible design
- Two to four internal time servers, each fed by several external or GPS sources.
- Every network device syncs to the internal servers, sourced from a loopback.
- Devices log in UTC with millisecond timestamps.
ntp server 10.0.0.123 prefer
ntp server 10.0.0.124
ntp source Loopback0
ntp update-calendar
service timestamps log datetime msec show-timezonentp update-calendar keeps the hardware clock in step, so the router boots with sane time.
ntp master makes a router serve its own clock (stratum 8 by default): fine in a lab or an isolated
network, wrong anywhere real sources exist.
They will ask next
Is a stratum 1 server always better than a stratum 2?
No. Stratum counts hops, not accuracy. A stratum 2 server on your LAN usually beats a stratum 1 across the internet, because path delay and jitter dominate the error.
What is SNTP?
Simple NTP: a client that takes time from a server without NTP's filtering and multi-server selection. Good enough for small devices, not for anything that serves time to others.
Traps
- Calling stratum 16 a low-quality sync. It means not synchronized at all.
- Using
ntp masterin production when real time sources exist.