Why time matters
Every computer keeps time with a quartz crystal, and crystals drift: 20 parts per million is almost 2 seconds a day. Logs from different machines only line up if clocks agree, certificates check dates, and banks must timestamp trades.
Strata
The stratum-1 server is wired to a reference clock: a GPS receiver that takes time from the atomic clocks on GPS satellites and sends a pulse every second. The reference clock is called stratum 0; the server beside it is stratum 1.
The stratum-2 server sets its clock from stratum 1 over the network. Each hop adds one: your laptop will ask stratum 2, so it becomes stratum 3. Small errors add up along the way, and stratum 16 means "not synchronised".
NTP's four timestamps
The laptop reads its own clock, t1 = 10:00:00.000, and writes it into a request: a 48-byte NTP packet sent over UDP to port 123.
The server stamps t2 = 10:00:00.095 the moment the request arrives, and t3 = 10:00:00.096 just before its reply leaves. The 1 ms in between is the server's own work, not travel.
The reply carries t1, t2 and t3. The laptop stamps t4 = 10:00:00.031 on its own clock when the reply arrives. It now holds four timestamps, two from each clock.
Delay = (t4 − t1) − (t3 − t2) = 31 − 1 = 30 ms round trip. Offset = ((t2 − t1) + (t3 − t4)) / 2 = (95 + 65) / 2 = 80 ms: the laptop is 80 ms slow.
NTP assumes the trip out and back take equal time; half of any difference becomes error, at most 15 ms here. The laptop then slews: it runs its clock up to 0.05% fast, so the 80 ms is gone in 160 s.
PTP: hardware time
NTP reaches about a millisecond on a LAN; PTP (IEEE 1588) aims below a microsecond. The grandmaster, the best clock on the network, sends Sync and stamps t1 in hardware as it leaves the network card; a Follow_Up then carries that exact t1.
The switch sends Delay_Req (t3); Delay_Resp returns t4. Path delay = ((t2 − t1) + (t4 − t3)) / 2 = (800 + 200) / 2 = 500 ns; offset = 800 − 500 = 300 ns: the switch is 300 ns ahead.
The switch is a boundary clock: synced to the grandmaster on one port, it acts as master on its others. Each link is timed on its own, so time spent waiting in the switch's queues adds no error downstream.
On the wire, in numbers
;; step 1/11 · why-time · local
;; at your laptop
quartz tolerance ±20 ppm
drift 20 × 10⁻⁶ × 86 400 s = 1.728 s per day
logs events from two servers sort in the wrong order
certificates TLS checks notBefore ≤ now ≤ notAfter (RFC 5280)
finance EU high-frequency trading: within 100 µs of UTC
(Delegated Regulation 2017/574, MiFID II RTS 25)
NTP version 4 is RFC 5905: a 48-byte header over UDP port 123, offset θ = ((t2 − t1) + (t3 − t4)) / 2 and delay δ = (t4 − t1) − (t3 − t2). Real clients poll several servers repeatedly and filter the samples. Clock readings are illustrative (the laptop 80 ms slow, 15 ms each way); the arithmetic on them is exact. The 128 ms step threshold and 500 ppm slew limit are the reference implementation's defaults.