NTP

What is NTP?

NTP (Network Time Protocol) is a network protocol that lets computers, servers and industrial devices synchronise their system clocks with a reliable time source over an IP network, by exchanging timestamps and calculating the network delay from them. The current version, NTPv4, was defined in RFC 5905 in 2010 and runs over UDP port 123. On a local network NTP typically achieves accuracy better than one millisecond; over the internet, a few tens of milliseconds.

NTP is the quiet foundation beneath correct log ordering, process control and security in both IT and OT environments: without clocks that agree, no timeline can be trusted.

🎯 Why does time synchronisation matter so much?

The clock in a computer or PLC never runs perfectly. An ordinary quartz crystal typically deviates by 10 to 50 ppm, roughly 1 to 4 seconds a day, and after a few months without correction systems are minutes apart. That has direct consequences:

• Log ordering and forensics - during an incident you need to put events from firewalls, servers and controllers in the correct order. Drifting clocks make forensic investigation and incident response unreliable.
• Correlation in the SIEM - a SIEM links alerts from different sources by time; a difference of a few seconds can hide an attack pattern completely.
• Authentication - Kerberos in Active Directory rejects logons by default when clocks differ by more than five minutes, and certificates are checked against their validity dates.
• Process data - a historian, batch control and SCADA need correct timestamps to reconstruct trends, batch reports and audit trails.
• Alarms - alarm management and first-out analysis rely on the first alarm really being the first one.
• Redundancy and failover - when a redundant server or controller takes over, both must keep the same time; otherwise gaps or duplicate records appear in the process data.

⚙️ How does NTP work technically?

An NTP client periodically asks one or more servers for the time. Each exchange produces four timestamps: T1 (client sends), T2 (server receives), T3 (server sends) and T4 (client receives). From these the client calculates:

• Offset (clock difference) = ((T2 − T1) + (T3 − T4)) / 2
• Delay (round-trip delay) = (T4 − T1) − (T3 − T2)

NTP assumes the outbound and return paths take equally long. If the path is asymmetric, for example because of a congested uplink or a slow VPN tunnel, an error of up to half that difference appears. By querying several servers and filtering out outliers, NTP selects the most reliable source and ignores a deviating “falseticker”.

The client then adjusts its clock gradually. The reference implementation ntpd speeds up or slows down the clock (slewing) by at most 500 ppm, so that no time jumps occur. Only when an offset of more than 128 milliseconds persists is the clock set in one go (stepping), and by default ntpd exits above 1,000 seconds, because something is then fundamentally wrong. The poll interval runs from 64 to 1,024 seconds by default and grows as the clock becomes more stable.

🧱 What does the NTP hierarchy (stratum) look like?

NTP organises time sources in layers called strata. The lower the number, the closer to the reference clock:

In practice, end devices such as a PLC, HMI, SCADA server or historian are clients at stratum 3 or 4. Every extra layer adds a little inaccuracy, so keep the chain short.

🔄 What is the difference between NTP, SNTP, PTP and IRIG-B?

NTP and PTP complement each other: PTP for equipment that needs microseconds, NTP for everything where milliseconds are enough. In many installations a time server with a GNSS receiver provides both NTP and the PTP grandmaster signal.

🔐 What security risks does NTP have?

Classic NTP has no built-in authentication of the time it receives. That makes it an attractive target:

• Time manipulation - through spoofing or a man-in-the-middle attack, an attacker can shift the clock. Consequences: certificates that appear expired or not yet valid, failed Kerberos logons, or a replay attack that suddenly looks “valid” again.
• GNSS interference - jamming or spoofing of satellite signals hits the stratum 1 server and with it the entire network.
• Amplification attacks - in December 2013 the monlist feature of older ntpd versions (CVE-2013-5211) was widely abused for DDoS attacks: a small request with a forged source address produces a much larger response towards the victim. Version 4.2.7p26 fixed this; restrict default ... noquery blocks such queries.
• Public dependency - an OT network that queries public NTP servers directly needs an open outbound connection, which runs counter to network segmentation.

The answer is Network Time Security (NTS), defined in RFC 8915 in 2020. NTS establishes keys over TLS and then authenticates every NTP packet, so the client knows the time really comes from the intended server. Not all OT devices support NTS yet, so an internal, well-protected time server remains the core of the defence.

🏭 How do you set up NTP in an OT network?

A proven approach follows the Purdue Model and the zones and conduits of IEC 62443-3-3, whose requirement SR 2.11 (Timestamps) calls for timestamps on audit records. Requirement enhancement RE 1 adds synchronisation with a system-wide time source from security level 2, and RE 2 adds protection of that time source’s integrity at security level 4:

1. Choose your own primary source - install a stratum 1 time server with a GNSS receiver (preferably GPS and Galileo) and a holdover oscillator, so that time stays stable for hours to days if the satellites are lost.
2. Build in redundancy - use at least three independent sources, so that NTP can outvote a deviating clock. With two sources, a disagreement cannot be resolved.
3. Distribute per zone - let an NTP server in the DMZ or IDMZ pass time on to the OT zones, and allow only UDP 123 from that server to the clients in the firewall. That way segmentation does not require an internet connection from the process network.
4. Configure the clients - point PLCs, HMIs, switches and servers to the same internal servers, use UTC as system time and apply local time zones only in the presentation layer.
5. Harden the servers - disable management queries, restrict who may synchronise and use NTS or symmetric keys where devices support them; see also hardening.
6. Monitor time - track offset and stratum, alarm on stratum 16 or an offset above a threshold (for example 100 ms), and forward those alerts via Syslog to the SIEM.

In a Windows domain the PDC emulator of the forest root domain is the time source for all domain controllers; let that server synchronise with the internal stratum 1 source. Since version 8, Red Hat Enterprise Linux ships only chrony; ntpd is no longer supported there. Note that chrony serves other clients only once you permit them with an allow directive.

🇪🇺 What Dutch and European context is relevant?

• TimeNL - SIDN Labs, together with VSL, SURF and the Trifecta Tech Foundation, runs a public stratum 1 service fed by GPS, Galileo, the DCF77 signal and atomic clocks, including the official Dutch time UTC(VSL). NTS has been in production there since early 2022.
• ISO 27001 - control A.8.17 (Clock synchronisation) in the 2022 edition requires the clocks of relevant systems to be synchronised with approved time sources.
• NIS2 and the Dutch Cybersecurity Act - the duty of care calls for logging, detection and incident handling; reliable time is a silent precondition for all of these, especially given the tight reporting deadlines.
• Leap seconds - the most recent one was added on 31 December 2016. In 2022 the CGPM decided to increase the permitted difference between UTC and Earth rotation by 2035 at the latest, which will effectively end leap seconds.

❓ Frequently asked questions

Which port does NTP use?

NTP uses UDP port 123, for the server and usually for the client as well. Network Time Security adds a TLS connection for key exchange, by default on TCP port 4460. In an OT firewall, you should preferably allow NTP only from the internal time server.

How accurate is NTP?

On a local network with modern equipment, NTP typically achieves accuracy better than one millisecond. Over the internet, NTP accuracy is more in the range of a few tens of milliseconds, mainly because of asymmetric network paths. If you need microseconds, use PTP instead.

What does stratum 16 mean in NTP?

Stratum 16 in NTP means that a device is not synchronised with a valid time source. Strata 1 to 15 are valid layers, where a lower number is closer to the reference clock. A device at stratum 16 deserves an alarm in your monitoring.

Can an OT network use public NTP servers?

An OT network should preferably not query public NTP servers directly, because that requires an outbound internet connection and the time is not authenticated. Use an internal time server with its own GNSS receiver, optionally supplemented through the DMZ with a trusted public source that supports NTS.

What is the difference between NTP and SNTP?

SNTP is a simplified form of NTP that uses the same packet format but does not filter and combine multiple sources. SNTP is therefore lighter and less accurate, and suitable for simple devices. Full NTP is better for servers and for sources that other systems depend on.

What is NTS?

NTS (Network Time Security) is the security extension of NTP defined in RFC 8915 in 2020. NTS uses TLS to agree keys and then authenticates every NTP packet, so an attacker cannot falsify the time unnoticed. A growing number of servers and clients, such as chrony, support NTS.

📌 In summary

NTP keeps all your systems on a single timeline: the precondition for trustworthy logs, working authentication, correct process data and forensic investigation. Set up NTP with your own GNSS-fed stratum 1 source, at least three independent servers, distribution per zone via the DMZ, and monitoring of offset and stratum. Secure time with NTS where possible, and use PTP where milliseconds are not enough. That makes time synchronisation a fixed part of OT convergence.