Network Time Protocol (NTP)
- NTP uses UDP port 123
- Time synchronization
- A simple query and response
- Is like a clock ticking 1, 2, 3 (port UDP 123)
- Provides clock synchronization
- More accurate than SNTP (Simple Network Time Protocol)
- Some lower end switches support SNTP
- NTPv3 support authentication
- Hash of the time encrypted by a key
- If your key can decrypt that time hashed then you are synchonized
NTP Devices
- Appliance
- Switch
- Router
- Domain Controller
- Responsible for telling all the other systems what the time is
- If your time is off by some time, if that time is too far off by a range you wont be able to communicate
- Public Servers
- There is no authentication, because to authenticate they would have to tell you the key
NTP Advantages
- Reduce confusion
- Logging timestamps
- Digital certificate verification
- X.509v3 - standard for digital certificates
- Public mechanism for formatting digital certification
- If somebody gives me their certificates I need to say if it is valid, if it is invalid means your VPN tunnel doesn't work
NTP Pitfalls
- We all start daylight saving times in different times of the year
- In some locations clocks changes more than it other places
- What time zone are you?
- Time zones
- Daylight saving time
- Daylight saving dates
- Can be spoofed if not secure
- If we set the time too far in the future or in the past it will make certificates fail
- NTP can be targeted by attackers
NTP Stratums
- Stratum 0:
- Not directly connected to the network
- High-precision time sources (e.g., atomic clocks, GPS)
- Provides time to Stratum 1 devices
- Stratum 1:
- Directly connected to Stratum 0 devices
- Acts as primary time servers on a network
- Very accurate
- Stratum 2:
- Gets time from Stratum 1 servers
- May also peer with other Stratum 2 servers for redundancy
- Slightly less accurate due to added network delay
- Stratum 3 and below:
- Each level gets time from the stratum above it
- Increased network latency and reduced accuracy as stratum number increases
- NTP supports up to Stratum 15 (Stratum 16 means unsynchronized)