NTP (Network Time Protocol) – Complete Guide to Time Synchronization
1. NTP Basics
Definition: NTP is a networking protocol designed to synchronize the clocks of computers and network devices within milliseconds (typically 1–50ms).
Why is NTP Important?
✅ Log Correlation: Ensures timestamps in logs (Syslog, NetFlow) are aligned.
✅ Security: Protocols like Kerberos, certificates, and MFA depend on accurate time.
✅ Compliance: Needed for audits and legal records (e.g., SOX, HIPAA).
✅ Troubleshooting: Accurate sequencing of network events.
Example Issue Without NTP:
A firewall shows an attack at 10:00 AM, but a server shows it at 9:58 AM. Without time sync, the event chain becomes unreliable.
2. How NTP Works
Client-Server Model
NTP Client requests time from a server
Server responds with its current timestamp
Client adjusts its clock, compensating for delay
Stratum Levels (Hierarchy of Trust)
Stratum
Description
Example
0
Reference clock
GPS, atomic clock
1
Directly connected to Stratum 0
time.google.com
2
Syncs to Stratum 1
Corporate NTP server
3–15
Lower precision devices
Routers, switches
16
Unsynchronized
Invalid time
NTP Port & Protocol
Uses UDP port 123 (connectionless, fast)
Employs Marzullo’s algorithm to filter outliers
3. NTP Configuration
A. Configuring a Device as an NTP Client
Cisco Router/Switch
Router(config)# ntp server pool.ntp.org prefer
Router(config)# ntp server 192.168.1.100
Router(config)# ntp update-calendar
Linux (Ubuntu – Using Chrony)
sudo apt install chrony
sudo nano /etc/chrony/chrony.conf
# Add this line:
server pool.ntp.org iburst
sudo systemctl restart chrony