PlayInfoBox

Home /Network /What Is NTP (Network Time Protocol)? The Basics Explained

What Is NTP (Network Time Protocol)? The Basics Explained

It is the quiet protocol working behind your device's "set time automatically" option.

What NTP (Network Time Protocol) is

NTP is a standard protocol that lets computers, servers, and network equipment periodically check their own internal clock against accurate time servers on the internet, using UDP port 123. It works much like glancing at a radio time signal to correct a wristwatch, except devices do it to each other automatically.

Why accurate time actually matters

Browsers validate an HTTPS certificate's expiry window against your device's own clock, so a badly skewed clock can trigger certificate errors on perfectly valid sites. One-time password (OTP) authenticator apps generate codes based on the current time, so a large time gap between device and server causes repeated authentication failures. Comparing logs across multiple servers in the right order also only makes sense if every server's clock agrees.

The stratum hierarchy

Stratum 0 refers to a top-level reference clock, such as an atomic clock or GPS receiver, that is not itself connected to a network. A server directly attached to that reference becomes stratum 1 and supplies time to other servers; a server that references a stratum 1 server becomes stratum 2, and so on. The lower the stratum number, the closer that server sits to the original reference clock.

How NTP corrects for error

An NTP client queries several time servers, estimates the round-trip network delay from the time between sending a request and receiving a reply, and calculates the offset between its own clock and each server's reported time. It discards outlier responses and, rather than jumping the clock abruptly, gradually speeds up or slows down its own clock rate β€” a method that typically keeps devices synchronized to within milliseconds to a few tens of milliseconds.

Where NTP shows up in everyday devices

Windows, macOS, Android, and iOS all include a built-in "set time automatically" feature that runs on NTP under the hood. If that setting is turned off, or a firewall blocks NTP traffic on UDP port 123, a device's internal clock will gradually drift, eventually causing problems like failed sign-ins or certificate errors that seem to come out of nowhere.

The security risk tied to NTP

A loosely configured public NTP server can be abused for an NTP amplification attack, where an attacker sends a small spoofed request that tricks the server into sending a much larger response to a victim's IP address, forming one variety of DDoS attack. Anyone running their own NTP server is generally advised to restrict who can query it and keep the software patched against known vulnerabilities.

The four timestamps behind every exchange

A single NTP exchange records four times: when the client sent its request (T1), when the server received it (T2), when the server replied (T3), and when the client received the reply (T4). The round-trip delay is (T4 - T1) minus the server's processing time (T3 - T2), and the clock offset is estimated as ((T2 - T1) + (T3 - T4)) / 2. The estimate assumes the outbound and return paths take about the same time, which is why asymmetric network paths are a common source of small residual errors.

NTP versus SNTP

SNTP (Simple NTP) uses the same packet format but skips the filtering and clock-discipline algorithms: it asks one server and sets the clock. Many phones, embedded devices, and basic clients use SNTP because it is light. Full NTP implementations such as ntpd and chrony query several servers, filter noise, and track the drift of the local oscillator, which gives steadier results.

Public servers and the NTP pool

Most home devices use a vendor default such as time.windows.com or time.apple.com, while Linux systems often use the community-run pool.ntp.org, which maps a name to many volunteer servers and spreads load. Large organizations typically run internal servers that sync upstream and serve their own network, so thousands of machines do not each hit a public server.

Leap seconds and time smearing

Because Earth's rotation is irregular, UTC has occasionally inserted a leap second. Handling it is awkward for software: some systems repeat a second, others pause. Several large operators avoid the jump by smearing, slowly stretching the clock over many hours so the extra second is absorbed gradually. Mixing smeared and non-smeared servers in one client's list can produce confusing offsets, so choose one style.

Authenticated time with NTS

Classic NTP packets are not authenticated by default, so an attacker on the path could in principle shift a client's clock. Network Time Security (NTS, standardized in RFC 8915) adds a key exchange over TLS and authenticated NTP packets. It is supported by newer clients such as recent versions of chrony and by some public services, and is worth enabling where available.

Why NTP still matters even with GPS everywhere

GPS receivers deliver extremely accurate time, but most everyday devices β€” laptops, phones indoors, IoT sensors, servers in a data center β€” have no GPS receiver of their own and no clear line of sight to satellites anyway. Instead, they climb the stratum hierarchy: a handful of GPS- or atomic-clock-connected stratum 1 servers distribute time down through a large pool of public and organizational NTP servers, so accurate time reaches virtually every internet-connected device without needing its own reference clock.

A caveat: NTP's precision has real limits

Typical NTP synchronization lands within single-digit to a few tens of milliseconds, which is more than good enough for browsing, authentication, and general logging. Financial trading systems, telecom networks, and scientific instruments that need microsecond- or nanosecond-level precision instead rely on PTP (Precision Time Protocol), a more demanding standard designed for controlled, low-latency networks rather than the open internet. If a project's requirements mention sub-millisecond timing, NTP alone is usually not the right tool.

How to check and fix a drifting clock

On Windows, open the date and time settings and confirm that automatic time is on; the command w32tm /query /status shows the source and last sync. On Linux, timedatectl shows whether the system clock is synchronized, and chronyc tracking reports the current offset when chrony is in use. If sync fails, check that outbound UDP port 123 is open, that DNS resolves the time server name, and that the hardware clock is not wildly off. In virtual machines, the host and guest can fight over time, so use one method of synchronization, not two. On a network you control, point all machines to the same internal source so their logs agree with one another.

Planning for the 2036 rollover

NTP counts seconds in a 32-bit field starting from 1900, which wraps around in 2036. The protocol handles this with an era number, and modern implementations resolve the ambiguity by assuming the time is near their build or current date. Very old embedded devices that cannot be updated may misbehave, so inventory long-lived equipment, such as industrial controllers, before then. This is the same family of problem as the better-known 2038 issue in 32-bit Unix timestamps, but the two are separate.

Frequently Asked Questions

What actually goes wrong if a computer's clock is off?

Common symptoms include certificate errors when visiting otherwise normal HTTPS sites, two-factor authentication (OTP) codes that keep getting rejected as invalid, and difficulty comparing logs from multiple servers in the correct chronological order.

Do smartphones sync time using NTP too?

Yes. Most smartphones automatically sync their clock over the carrier network or the internet whenever an option like "use network-provided time" is enabled in settings. Turning that option off leaves the phone relying solely on its own internal clock, which can gradually drift out of sync.

Is NTP's amplification problem still a concern?

The best-known case came from an old monlist command in ntpd that returned a long list of recent clients, and it was fixed in later software versions. Servers that are updated and configured to answer only their intended clients are far less useful to attackers. Old unpatched devices exposed to the internet remain the risk.

What is the difference between NTP and the clock on my phone's carrier network?

Mobile carriers also broadcast time to phones through the cellular network, and phones may use either that or NTP-style internet sync depending on settings. Both aim at the same UTC time; the carrier signal is often coarser, which is why internet sync is used for finer accuracy.

How many time servers should a client use?

Using at least three or four independent sources lets the client detect and ignore one that is wrong. One server is a single point of failure, and two servers disagree with no way of telling which is right.