Network Time Protocol (NTP)

• NTP uses UDP port 123
  • Time synchronization
  • A simple query and response
  • Is like a clock ticking 1, 2, 3 (port UDP 123)
• Provides clock synchronization
• More accurate than SNTP (Simple Network Time Protocol)
  • Some lower end switches support SNTP
• NTPv3 support authentication
  • Hash of the time encrypted by a key
  • If your key can decrypt that time hashed then you are synchonized

NTP Devices

• Appliance
• Switch
• Router
• Domain Controller
  • Responsible for telling all the other systems what the time is
  • If your time is off by some time, if that time is too far off by a range you wont be able to communicate
• Public Servers
  • There is no authentication, because to authenticate they would have to tell you the key

NTP Advantages

• Reduce confusion
• Logging timestamps
• Digital certificate verification
  • X.509v3 - standard for digital certificates
    • Public mechanism for formatting digital certification
      • Takes Pub key, cert, CA, ID.
        !X.509v3.excalidraw
• If somebody gives me their certificates I need to say if it is valid, if it is invalid means your VPN tunnel doesn't work

NTP Pitfalls

• We all start daylight saving times in different times of the year
  • In some locations clocks changes more than it other places
  • What time zone are you?
• Time zones
• Daylight saving time
• Daylight saving dates
• Can be spoofed if not secure
  • If we set the time too far in the future or in the past it will make certificates fail
  • NTP can be targeted by attackers

NTP Stratums

• Stratum 0:
  • Not directly connected to the network
  • High-precision time sources (e.g., atomic clocks, GPS)
  • Provides time to Stratum 1 devices
• Stratum 1:
  • Directly connected to Stratum 0 devices
  • Acts as primary time servers on a network
  • Very accurate
• Stratum 2:
  • Gets time from Stratum 1 servers
  • May also peer with other Stratum 2 servers for redundancy
  • Slightly less accurate due to added network delay
• Stratum 3 and below:
  • Each level gets time from the stratum above it
  • Increased network latency and reduced accuracy as stratum number increases
  • NTP supports up to Stratum 15 (Stratum 16 means unsynchronized)