How NTP Works: Time Sync, Stratum & Why SOC Teams Care (Animated)

NTP keeps every device’s clock in sync. It sounds boring until it breaks: log timelines stop lining up during an investigation, certificates look expired, and domain logins fail. For a SOC, trustworthy time is evidence.

1. Ask for the time: four timestamps

The client sends its time; the server notes when it received the request and when it replied. With these four timestamps the client calculates the network delay and how far off its own clock is.

1. NTP REQUEST (Your server → Time server): T1: when the client sent the request.
2. NTP REPLY (Time server → Your server): The client receives it at T4 and computes the offset, then gently corrects its clock.

Wireshark filter:

ntp

2. Why the soc cares: logs must line up

During an incident analysts merge logs from firewalls, servers and endpoints. If one clock is minutes off, events appear in the wrong order and the story of the attack is wrong.

1. NTP REQUEST (Your server → Time server): Clients keep checking so drift never builds up.
2. NTP REPLY (Time server → Your server): Tiny corrections keep every log timestamp trustworthy.

Check a windows host:

w32tm /query /status
Linux: timedatectl status

3. Fake time: attack: a forged time source

Plain NTP has no authentication. An attacker able to answer time requests (on the local network, or through a spoofed reply) can shift a clock: expired certificates start to look valid, domain logins break, and logs are scrambled.

1. NTP REQUEST (Your server → Time server): An ordinary time request.
2. NTP REPLY (Attacker → Your server): A forged answer arrives first.

Wireshark filter:

ntp.flags.mode == 4 && ip.src != 203.0.113.123

4. Nts & multiple sources: defence: authenticated, cross-checked time

Use several time sources so one bad answer is outvoted, use NTS (authenticated NTP) where supported, allow NTP only from your own time servers, and alert on large time jumps.

1. NTP REPLY (Attacker → Your server): Unauthenticated time is rejected.
2. NTS REPLY (Time server → Your server): Only authenticated answers set the clock.

Linux (chrony):

server time.cloudflare.com iburst nts
server nts.netnod.se iburst nts

FAQ