Every computer needs to know what time it is. Not approximately—precisely. Financial transactions require microsecond timestamps. Distributed databases depend on clock agreement to order events. Certificate expiration checks fail when clocks drift. The entire security infrastructure of the internet assumes machines can agree on the current moment.

The Network Time Protocol has solved this problem since 1985. It's one of the oldest internet protocols still in active use, and it accomplishes something remarkable: extracting accurate time from fundamentally unreliable networks. Packets arrive late, routes change unpredictably, and the internet offers no guarantees about delivery timing.

NTP doesn't fight this unreliability—it works with it. Through clever mathematics, hierarchical trust, and patient clock adjustment, it achieves millisecond-level synchronization across the globe. Understanding how NTP works reveals elegant engineering solutions to problems that seem impossible at first glance.

NTP's core algorithm looks deceptively simple. A client sends a request to a server, noting the departure time. The server receives it, notes arrival time, processes the request, notes departure time, and sends a response. The client records when the response arrives. Four timestamps, one equation.

The calculation assumes network delay is symmetric—that packets take equally long traveling in each direction. With this assumption, NTP computes the clock offset as (receive_time - send_time + response_send - response_receive) / 2. The round-trip delay is (response_receive - send_time) - (response_send - receive_time). Simple arithmetic extracts both offset and network delay.

But the symmetry assumption is often wrong. Asymmetric routing sends packets through different paths in each direction. Queuing delays differ based on traffic patterns. Satellite links add hundreds of milliseconds in one direction. When delay asymmetry exceeds a few milliseconds, the offset calculation introduces systematic error that NTP cannot detect or correct.

NTP addresses this limitation through statistical filtering and multiple servers. Each exchange produces an offset estimate. NTP maintains a sliding window of recent measurements, discarding outliers and selecting samples with the lowest delay—reasoning that lower delay implies less opportunity for asymmetry. By combining estimates from multiple independent servers, random asymmetries tend to cancel out, leaving the systematic component as the dominant error source.

Takeaway

Accurate measurement doesn't require reliable infrastructure—it requires algorithms designed around the specific ways that infrastructure fails.

When NTP detects that a system clock is wrong, it faces a choice: step the clock instantly or adjust it gradually. Stepping seems obvious—if you're wrong, fix it immediately. But clock steps break things. Scheduled tasks misfire. Log timestamps become non-monotonic. Database transactions that appeared to take milliseconds suddenly span hours. File modification times travel backward.

NTP uses clock discipline instead—a feedback control loop that slowly steers the clock toward the correct time. The algorithm adjusts frequency rather than time directly. If the clock is behind, NTP makes it tick slightly faster. If ahead, slightly slower. The maximum slew rate is typically 500 parts per million, meaning a one-second error takes about 2000 seconds to correct.

The discipline algorithm maintains both offset and frequency state. Offset represents current error; frequency represents drift rate. Most system clocks drift predictably—they're consistently fast or slow by a measurable amount. NTP learns this drift and compensates continuously, reducing the offset corrections needed.

When offset exceeds 128 milliseconds, NTP considers stepping the clock anyway—gradual adjustment would take too long. Above 1000 seconds of offset, NTP assumes something catastrophic happened and refuses to adjust at all, requiring manual intervention. These thresholds represent engineering judgment about acceptable tradeoffs between accuracy and system stability.

Takeaway

The best corrections are the ones that happen slowly enough that nothing notices—stability often matters more than immediate accuracy.

At the top of NTP's hierarchy sit stratum 0 devices: atomic clocks, GPS receivers, and radio time signals. These aren't network-accessible—they're reference clocks connected directly to stratum 1 servers. Stratum 1 servers synchronize directly from these sources and serve time to stratum 2 servers, which serve stratum 3, and so on down to stratum 15.

Each hop increases stratum number and decreases expected accuracy. A stratum 2 server inherits error from its stratum 1 source plus any asymmetry in their connection. By stratum 4 or 5, accumulated error typically reaches tens of milliseconds. This hierarchy serves two purposes: load distribution and failure isolation.

A single stratum 1 server cannot handle millions of clients. The hierarchy spreads load across thousands of intermediate servers. When a stratum 1 server fails, its stratum 2 clients switch to alternatives while continuing to serve their downstream clients with slightly degraded accuracy. The system degrades gracefully rather than failing completely.

NTP clients should always configure multiple upstream servers—typically three to five from different organizations. This redundancy enables intersection algorithms that detect misbehaving servers. If four servers agree within milliseconds but one is off by seconds, NTP identifies and ignores the outlier. No single point of failure can corrupt timekeeping for a well-configured client.

Takeaway

Hierarchical systems trade some accuracy for massive gains in resilience—perfect centralized solutions rarely survive contact with global-scale infrastructure.

NTP succeeds through humility about what networks can guarantee. It assumes delays are variable, paths are asymmetric, and servers occasionally lie. Rather than requiring reliable infrastructure, it builds reliability from unreliable components through redundancy, filtering, and gradual correction.

The protocol's longevity proves something important about network engineering: simple algorithms that work robustly beat complex algorithms that work optimally. NTP's math is straightforward. Its genius lies in acknowledging failure modes and designing around them.

Modern systems increasingly demand microsecond precision that NTP cannot reliably provide. Precision Time Protocol addresses some limitations, and GPS-disciplined clocks bypass networks entirely. But for the vast majority of internet systems, NTP remains sufficient—forty years of quiet, essential service.