NTP

networking

Stands for: Network Time Protocol

The Network Time Protocol: the protocol that keeps clocks across a network agreeing with each other, and with the rest of the world.

The protocol that keeps clocks across a network agreeing with each other. Certificates, Kerberos and log correlation all fail in confusing ways when it is wrong.

Clock agreement is one of those dependencies nobody lists until it breaks, and then everything breaks at once. Certificates validate against a clock, so a device whose time is wrong rejects good certificates and may accept expired ones. Kerberos refuses tickets outside a tolerance, usually five minutes, so an authentication failure that looks like a password problem is often a clock problem. Log correlation across systems is meaningless without a shared timebase: two events cannot be ordered if the machines disagree about when they happened, and an incident timeline assembled from unsynchronised logs is fiction. NTP handles this by measuring round-trip delay and offset against a hierarchy of sources, where stratum 0 is a reference clock such as GPS or an atomic standard, stratum 1 is a server attached directly to one, and each layer down adds a number and a little error. It disciplines the clock rather than setting it, slewing gradually so that time never jumps backwards - because software that sees time move backwards behaves in ways nobody designed for. The security consideration worth knowing is that unauthenticated NTP is a place to attack: an attacker who controls your time can expire your certificates, break your Kerberos, or replay something you would otherwise reject as stale. NTP has authentication, and most deployments do not use it.

Also known as: ntp

← All glossary entries