Term | Explanation |
Characters before the address have these definitions: * Synchronized to this peer # Almost synchronized to this peer + Peer selected for possible synchronization - Peer is a candidate for selection ~ Peer is statically configured | |
address | This is the IP address of the peer. In the example, the first entry shows 127.127.7.1. This indicates that the local machine has synced with itself. Generally, only an NTP master syncs with itself. |
ref clock | This is the address of the reference clock for the peer. In the example, the first six peers/servers have a private IP as the reference clock, so their masters are probably routers, switches, or servers within the local network. For the last four entries, the reference clock is a public IP, so their masters are probably a public time source. |
st | NTP uses the concept of a stratum in order to describe how far away (in NTP hops) a machine is from an authoritative time source. For example, a stratum 1 time server has a radio or atomic clock directly attached to it. It sends its time to a stratum 2 time server through NTP, and so on up to stratum 16. A machine running NTP automatically chooses the machine with the lowest stratum number with which it can communicate and uses NTP as its time source. |
when | The time since the last NTP packet was received from a peer is reported in seconds. This value should be lower than the polling interval. |
poll | The polling interval is reported in seconds. The interval usually starts with a minimum of 64-second poll intervals. The RFC specifies that no more than one NTP transaction per minute is needed in order to synchronize two machines. As NTP becomes stable between a client and a server, the poll interval may increase in small steps from 64 seconds up to 1024 seconds and generally stabilizes somewhere in between. But, this value dynamically changes, based on the network conditions between the client and the server and the loss of NTP packets. If a server is unreachable for some time, the poll interval is increased in steps to 1024 seconds in order to reduce network overhead. It is not possible to adjust the NTP poll interval on a router, because the internal is determined by heuristic algorithms. |
reach | Peer reachability is a bit string reported as an octal value. This field shows whether the last eight packets were received by the NTP process on the Cisco IOS ® software. The packets must be received, processed, and accepted as valid by the NTP process and not just by the router or switch that receives the NTP IP packets. Reach uses the poll interval for a time out in order to decide whether a packet was received or not. The poll interval is the time that NTP waits before it concludes that a packet was lost. The poll time can be different for different peers, so the time before reach decides that a packet was lost can also different for different peers. In the example, there are four different reach values: 377 octal = 11111111 binary, which indicates the NTP process received the last eight packets. 0 octal = 00000000, which indicates the NTP process did not receive any packet. 1 octal = 00000001, which indicates the NTP process received only the latest packet. 357 octal = 11101111, which indicates the packet before the latest four packets was lost. Reach is a good indicator of whether NTP packets are being dropped because of a poor link, CPU issues and other intermittent problems. Convert octal < - > binary is an online unit converter for this and many other conversions. |
delay | The round-trip delay to peer is reported in milliseconds. In order to set the clock more accurately, this delay is taken into account when the clock time is set. |
offset | Offset is the clock time difference between the peers or between the master and client. This value is the correction that is applied to a client clock in order to synchronize it. A positive value indicates the server clock is higher. A negative value indicates the client clock is higher. |
disp | Dispersion, reported in seconds, is the maximum clock time difference that was ever observed between the local clock and server clock. In the example, dispersion is 0.3 for the server 10.50.36.42, so the maximum time difference ever observed locally between the local clock and the server clock is 0.3 seconds. You can expect to see a high value when the clocks are syncing initially. But, if the dispersion is too high at other times, the NTP process on the client does not accept NTP messages from the server. Maximum dispersion is 16000; in the example, that is the dispersion for servers 10.50.44.69 and 10.50.44.133, so the local client does not accept time from these servers. If the reach is zero and dispersion is very high, the client is probably not accepting messages from that server. Refer to the second line of the example: address ref clock st when poll reach delay offset disp ~10.50.44.69 10.50.36.106 5 21231 1024 0 3.8 -4.26 16000. Even though the offset is just -4.26, the dispersion is very high (perhaps due to a past event), and the reach is zero, so this client does not accept time from this server. |
Term | Explanation |
configured | This NTP clock source has been configured to be a server. This value can also be dynamic, where the peer/server was dynamically discovered. |
our_master | The local client is synchronized to this peer. |
selected | The peer/server is selected for possible synchronization, when 'our_master' fails or the client loses sync. |
sane | Sanity tests are used in order to test the NTP packet received from a server. These tests are specified in RFC 1305, Network Time Protocol (Version 3) Specification, Implementation and Analysis . The tests are: Packet data is valid if tests 1 to 4 are passed. The data is then used in order to calculate offset, delay, and dispersion. Packet header is valid if tests 5 to 8 are passed. Only packets with a valid header can be used to determine whether a peer can be selected for synchronization. |
insane | The sanity checks have failed, so time from the server is not accepted. The server is unsynced. |
valid | The peer/server time is valid. The local client accepts this time if this peer becomes the master. |
invalid | The peer/server time is invalid, and time will not be accepted. |
ref ID | Each peer/server is assigned a reference ID (label). |
time | Time is the last time stamp received from that peer/server. |
our mode/ peer mode | This is the state of the local client/peer. |
our poll intvl/ peer poll intvl | This is the poll interval from our poll to this peer or from the peer to the local machine. |
root delay | Root delay is the delay in milliseconds to the root of the NTP setup. Stratum 1 clocks are considered to be at the root of an NTP setup/design. In the example, all three servers can be the root because they are at stratum 1. |
root dispersion | Root dispersion is the maximum clock time difference that was ever observed between the local clock and the root clock. Refer to the explanation of 'disp' under the show ntp association section for more details. |
sync dist. | This is an estimate of the maximum difference between the time on the stratum 0 source and the time measured by the client; it consists of components for round trip time, system precision, and clock drift since the last actual read of the stratum source. In a large NTP setup (NTP servers at stratum 1 in the internet, with servers that source time at different strata) with servers/clients at multiple strata, NTP synchronization topology should be organized in order to produce the highest accuracy, but must never be allowed to form a time sync loop. An additional factor is that each increment in stratum involves a potentially unreliable time server, which introduces additional measurement errors. The selection algorithm used in NTP uses a variant of the Bellman-Ford distributed routing algorithm in order to compute the minimum-weight spanning trees rooted on the primary servers. The distance metric used by the algorithm consists of the stratum plus the synchronization distance, which itself consists of the dispersion plus one-half the absolute delay. Thus, the synchronization path always takes the minimum number of servers to the root; ties are resolved on the basis of maximum error. |
delay | This is the round trip delay to peer. |
precision | This is the precision of the peer clock in Hz. |
version | This is the NTP version number used by the peer. |
org time | This is the time stamp of the NTP packet originator; in other words, it is this peer's time stamp when it created the NTP packet but before it sent the packet to the local client. |
rcv time | This is the time stamp when the local client received the message. The difference between org time and rcv time is the offset for this peer. In the example, master 10.4.2.254 has these times: org time D36968B7.E74172BF (02:11:03.903 UTC Fri May 25 2012) rcv time D36968B7.A2F44E2C (02:11:03.636 UTC Fri May 25 2012) The difference is the offset of 268.3044 msec. |
xmt time | This is the transmit time stamp for the NTP packet the local client sends to this peer/server. |
filtdelay filtoffset filterror | This is the round trip delay in milliseconds of each sample. This is the clock offset in milliseconds of each sample. This is the approximate error of each sample. A sample is the last NTP packet received. In the example, master 10.4.2.254 has these values: filtdelay = 2.99 2.88 976.61 574.65 984.71 220.26 168.12 2.72 filtoffset = 268.30 172.15 -452.49 -253.59 -462.03 -81.98 -58.04 22.38 filterror = 0.02 0.99 1.95 1.97 2.00 2.01 2.03 2.04 These eight samples correspond to the value of the reach field, which shows whether the local client received the last eight NTP packets. |
Test | Mask | Explanation |
1 | 0x01 | Duplicate packet received |
2 | 0x02 | Bogus packet received |
3 | 0x04 | Protocol unsynchronized |
4 | 0x08 | Peer delay/dispersion failed boundary check |
5 | 0x10 | Peer authentication failed |
6 | 0x20 | Peer clock unsynchronized (common for unsynched server) |
7 | 0x40 | Peer stratum out of bound |
8 | 0x80 | Root delay/dispersion failed boundary check |
Term | Explanation |
precision | Precision is determined automatically and is measured as a power of two. In the example, 2**18 means 2^(-18), or 3.8 microseconds. Loss of synchronization between NTP peers or between a master and client can be due to a variety of causes. NTP avoids synchronization with a machine whose time might be ambiguous in these ways: NTP never synchronizes to a machine that is not synchronized itself. NTP compares the time that is reported by several machines and does not synchronize to a machine whose time is significantly different from the others, even if its stratum is lower. |