VMware ESXi and vSphere Cluster Management

Network Time Protocol (NTP): Clock Synchronization, Stratum Levels, and UDP Port 123

Learn how NTP synchronizes network clocks, why accurate time matters, how stratum levels work, and how clients use UDP port 123.

What Is the Network Time Protocol?

Network Time Protocol (NTP) is an application-layer protocol that synchronizes device clocks across IP networks. It allows computers, servers, routers, switches, and other networked systems to maintain a shared and accurate understanding of time.

Clock synchronization means keeping a device's local time aligned with a selected time source. This is different from manually setting a clock once. A manually configured clock continues to drift, while an NTP client periodically checks its time and adjusts it as necessary.

NTP is commonly used in client-server relationships. An NTP client requests timing information, and an NTP server provides that information. The client then adjusts its local clock and continues checking the source because hardware clocks naturally become inaccurate over time.

Why Accurate Network Time Matters

Every computer has a local hardware clock, but no hardware clock keeps perfect time indefinitely. Clock drift is the gradual divergence of a local device clock from accurate time. Even a small difference can become important when many systems exchange data or depend on timestamps.

In an Active Directory environment, authentication commonly depends on closely aligned clocks. In the example used here, a difference of more than approximately five minutes between a workstation and its domain controller can prevent domain logon. Restoring NTP synchronization can correct the time mismatch and allow authentication to succeed.

How NTP Client-Server Synchronization Works

1. A client is configured with one or more NTP server hostnames or IP addresses.
2. The client resolves a hostname with DNS if a name is used.
3. The client periodically sends an NTP request to an available server.
4. The server responds with timing information.
5. The client estimates the correct time and adjusts its local clock.
6. The client repeats the process because its local hardware clock continues to drift.

A client may obtain time from an internal organizational time server or from a public time service. In a small test environment, a host might contact a public NTP pool directly. In an enterprise, devices normally use designated internal time servers, which themselves obtain time from trusted upstream sources.

NTP does not merely set a clock and stop. Synchronization is periodic and ongoing. Depending on the operating system and the size of the correction, a client may make a gradual adjustment rather than abruptly changing the clock, helping applications maintain a sensible sequence of timestamps.

NTP Transport, Port, and Version

NTP uses UDP port 123. UDP avoids the connection setup associated with TCP and is suitable for short, periodic timing exchanges. A firewall must permit UDP port 123 between a client and its configured NTP server. A policy may need to allow outbound requests from clients and the corresponding reply traffic, depending on the firewall design.

The NTP Stratum Hierarchy

Stratum is a hierarchy level indicating how far a time source is from an authoritative reference clock. A lower stratum number generally means that the source is closer to the reference clock. Stratum is not simply a measure of network distance or a guarantee that every lower-numbered server is more accurate in every situation; it describes the source's position in the NTP hierarchy.

Stratum 0: Reference Clocks

Stratum 0 consists of highly accurate reference devices, such as atomic clocks and GPS receivers. These devices provide the reference signal but are not normally ordinary network NTP servers. They are connected to or integrated with systems that provide NTP service.

Stratum 1 and Lower Levels

A stratum 1 server is directly connected to a stratum 0 reference device. A stratum 1 server can provide time to stratum 2 servers or clients. A stratum 2 system synchronizes from a stratum 1 source, and subsequent strata receive time farther down the hierarchy.

For example, an organization might have two internal stratum 2 time servers synchronized with trusted upstream stratum 1 servers. Domain controllers, routers, switches, servers, and workstations can then synchronize with those internal systems.

Public NTP Pool Example

Consider a host named Host A configured to use uk.pool.ntp.org as its time source. This hostname represents a DNS-based collection of public time servers rather than one permanently fixed server address.

1. Host A asks DNS to resolve uk.pool.ntp.org.
2. DNS returns an available server address from the pool.
3. Host A sends a periodic NTP request to that address using UDP port 123.
4. The NTP server returns timing information.
5. Host A uses the response to synchronize its local clock.
6. Host A repeats the process later, and DNS or the pool may provide an appropriate server address for a future exchange.

Conceptual client configuration: uk.pool.ntp.org
Transport: UDP
Destination port: 123
Purpose: periodic clock synchronization

The example illustrates the relationship, not a universal operating-system command. The exact configuration syntax depends on the platform and time-service software. Network policy must allow UDP port 123 between Host A and the selected time server.

Internal Enterprise NTP Design

A common deployment uses a small number of designated internal time servers. These systems synchronize with trusted upstream NTP sources, which may include organizational reference equipment, upstream stratum 1 servers, or suitable public services. Other internal devices use the designated servers instead of contacting public servers individually.

• Configure selected internal servers with trusted upstream sources.
• Configure domain controllers, routers, switches, servers, and workstations to use the internal servers.
• Use more than one internal time source where availability and redundancy are required.
• Permit UDP port 123 only along the paths needed for the time hierarchy.
• Monitor synchronization status so a failed source does not silently leave clients drifting.

This design reduces direct dependence on external public time servers and gives the organization a consistent internal time reference. Multiple sources also help a client continue synchronizing if one server becomes unavailable.

Troubleshooting NTP

A Client Does Not Synchronize

• Verify that the configured hostname resolves through DNS.
• Verify IP reachability between the client and the time server.
• Verify that host and network firewalls permit UDP port 123.
• Verify that the selected server is reachable and is serving time.
• Verify that the client is configured to use the intended hostname or IP address.
• Check whether the local time service is running and whether synchronization has been disabled by another configuration.

Domain Authentication Fails

1. Compare the workstation time with the Active Directory domain controller time.
2. Determine whether the difference exceeds the permitted authentication tolerance; in this example, the concern is a mismatch greater than approximately five minutes.
3. Check the workstation's configured NTP source and its connectivity.
4. Restore synchronization and confirm that the client clock is aligned before retrying authentication.

Logs Appear in the Wrong Sequence

• Check whether all devices use a consistent NTP source or hierarchy.
• Identify devices whose clocks have drifted because synchronization stopped.
• Confirm synchronized time before correlating security, application, and network events.

Exam-Relevant NTP Notes

• NTP is an application-layer protocol for clock synchronization across IP networks.
• NTP uses UDP, not TCP.
• The well-known NTP port is UDP 123.
• NTPv4 is compatible with NTPv3.
• Stratum 0 refers to reference clocks such as atomic clocks and GPS receivers.
• Stratum 0 devices are reference sources, not ordinary network NTP servers.
• Stratum 1 servers connect directly to stratum 0 references.
• Stratum 2 servers synchronize from stratum 1 servers.
• A lower stratum number generally indicates a source closer to the reference clock.
• NTP synchronization is periodic because local clocks drift.
• DNS resolves a pool hostname such as uk.pool.ntp.org before the client contacts a server address.
• In Active Directory environments, a clock mismatch of more than approximately five minutes can prevent domain authentication.

For a related reference, see Network Time Protocol.