3.4.4. Network Time Protocol

This link is a very good description of not only the output of “ntpq -p”, but of many things ntp related.

The following is stolen wholesale from the nottingham site:

More complete details are given on: ntpq standard NTP query program (source author), and other examples of the man ntpq pages.

NTP is a protocol designed to synchronize the clocks of computers over a (WAN or LAN) udp network. From Wikipedia

3.4.4.1. Documentation on the “ntpq -p” command

The Network Time Protocol (NTP) is a protocol and software implementation for synchronizing the clocks of computer systems over packet-switched, variable- latency data networks. Originally designed by David L. Mills of the University of Delaware and still maintained by him and a team of volunteers, it was first used before 1985 and is one of the oldest Internet protocols.

For an awful lot more than you might ever want to know about time and NTP, see The NTP FAQ, Time, what Time? and the current RFCs for NTP. The earlier Network Time Protocol (Version 3) RFC (txt, or pdf, Appendix E, The NTP Timescale and its Chronometry, p70) includes an interesting explanation of the changes in, and relations between, our timekeeping systems over the past 5000 years or so. Wikipedia gives a broader view in the articles Time and Calendar.

The command ntpq -p outputs a table such as for example:

remote                refid      st t when poll reach   delay   offset  jitter
==============================================================================
LOCAL(0)        .LOCL.          10 l  96h   64    0    0.000    0.000   0.000
*ns2.example.com 10.193.2.20      2 u  936 1024  377   31.234    3.353   3.096

3.4.4.1.1. Table headings

  • remote The remote peer or server being synced to. LOCAL is this local host (included in case there are no remote peers or servers available);

  • refid Where or what the remote peer or server is itself synchronised to;

  • st The remote peer or server Stratum

  • t Type

    • u: unicast or manycast client

    • b: broadcast or multicast client

    • l: local reference clock

    • s: symmetric peer

    • A: manycast server

    • B: broadcast server

    • M: multicast server (see Automatic Server Discovery)

  • when When last polled (seconds ago, h hours ago, or d days ago);

  • poll Polling frequency: rfc5905 suggests this ranges in NTPv4 from 4 (16s) to 17 (36h) (log2 seconds), however observation suggests the actual displayed

  • value is seconds for a much smaller range of 64 (26) to 1024 (210) seconds;

  • reach An 8-bit left-shift shift register value recording polls (bit set = successful, bit reset = fail) displayed in octal;

  • delay Round trip communication delay to the remote peer or server (milliseconds);

  • offset Mean offset (phase) in the times reported between this local host and the remote peer or server (RMS, milliseconds);

  • jitter Mean deviation (jitter) in the time reported for that remote peer or server (RMS of difference of multiple time samples, milliseconds);

3.4.4.1.2. Select Field tally code

The first character displayed in the table (Select Field tally code) is a state flag (see Peer Status Word) that follows the sequence

'' , x, -, #, +, *, o:

  • (empty) No state indicated for:

    • non-communicating remote machines,

    • LOCAL for this local host,

    • (unutilised) high stratum servers,

    • remote machines that are themselves using this host as their synchronisation reference;

The characters mean:

  • x Out of tolerance, do not use (discarded by intersection

    algorithm);

  • - Out of tolerance, do not use (discarded by the cluster

    algorithm);

  • # Good remote peer or server but not utilised (not among the first

    six peers sorted by synchronization distance, ready as a backup source);

  • + Good and a preferred remote peer or server (included by the

    combine algorithm);

  • * The remote peer or server presently used as the primary

    reference;

  • o PPS peer (when the prefer peer is valid). The actual system

    synchronization is derived from a pulse-per-second (PPS) signal, either indirectly via the PPS reference clock driver or directly via kernel interface.

    See the Clock Select Algorithm.

3.4.4.1.3. More about refid

The refid can have the status values:

An IP address The IP address of a remote peer or server;

  • .LOCL. This local host (a place marker at the lowest stratum included in case there are no remote peers or servers available);

  • .PPS. Pulse Per Second from a time standard;

  • .IRIG. Inter-Range Instrumentation Group time code;

  • .ACTS. American NIST time standard telephone modem;

  • .NIST. American NIST time standard telephone modem;

  • .PTB. German PTB time standard telephone modem;

  • .USNO. American USNO time standard telephone modem;

  • .CHU. CHU (HF, Ottawa, ON, Canada) time standard radio receiver;

  • .DCFa. DCF77 (LF, Mainflingen, Germany) time standard radio receiver;

  • .HBG. HBG (LF Prangins, Switzerland) time standard radio receiver;

  • .JJY. JJY (LF Fukushima, Japan) time standard radio receiver;

  • .LORC. LORAN-C station (MF) time standard radio receiver. Note, no longer operational (superseded by eLORAN);

  • .MSF. MSF (LF, Anthorn, Great Britain) time standard radio receiver;

  • .TDF. TDF (MF, Allouis, France) time standard radio receiver;

  • .WWV. WWV (HF, Ft. Collins, CO, America) time standard radio receiver;

  • .WWVB. WWVB (LF, Ft. Collins, CO, America) time standard radio receiver;

  • .WWVH. WWVH (HF, Kauai, HI, America) time standard radio receiver;

  • .GOES. American Geosynchronous Orbit Environment Satellite;

  • .GPS. American GPS;

  • .GAL. Galileo European GNSS;

  • .ACST. manycast server;

  • .AUTH. authentication error;

  • .AUTO. Autokey sequence error;

  • .BCST. broadcast server;

  • .CRYPT. Autokey protocol error;

  • .DENY. access denied by server;

  • .INIT. association initialized; indicates that NTP is initializing, and the server has not yet been reached.

  • .MCST. multicast server;

  • .RATE. (polling) rate exceeded;

  • .TIME. association timeout;

  • .STEP. step time change, the offset is less than the panic threshold (1000ms) but greater than the step threshold (125ms).

<https://support.f5.com/kb/en-us/solutions/public/10000/200/sol10240.html>

3.4.4.2. Example of a failed NTP peer server query

If the local ntpd process fails to communicate with an NTP peer server, the output from the ntpq command may appear similar to the following example:

# ntpq -np remote refid st t when poll reach delay offset jitter
==============================================================================
172.28.4.133 .INIT. 16 u - 64 0 0.000 0.000 0000.00

Note: An st (stratum) of 16 means that the destination NTP server is unreachable or is not considered a viable candidate.

In this example, the remote server information (refid, stratum, delay, offset, jitter) is not available. The value .INIT. in the refid column indicates that NTP is initializing, and the server has not yet been reached.

The value of 0 (zero) in the reach column indicates that the server has not been reached during any of the last eight attempts. The absence of a value in the when column indicates that no data has been received from the remote peer since the local ntpd process was started. The poll value of 64 is still at the MINPOLL value, which indicates that NTP was recently restarted.

NTP has a MINPOLL and MAXPOLL value, which it uses to determine the optimal time between updates with the reference server. If jitter is low, and there are no changes in data received, NTP automatically incrementally increases the poll value until it reaches MAXPOLL, or 1024 seconds.

Note: For an explanation of the inner workings of the octal shift register that displays in the reach column, and how to interpret the value contained therein, refer to Understanding NTP Reachability Statistics. This link takes you to a resource outside of AskF5. The third party could remove the document without our knowledge.

** End of borrowed content – Thanks folks!**