cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
12980
Views
1
Helpful
5
Replies

NTP packets and time stamps

sarahr202
Level 5
Level 5

Hi everybody.

I am trying to understand " time stamp" in NTP packets. I set up this lab in which R2 is the master and R1 is the client.

Then I capture the ntp packets between R1 and R2.

R1------199.199.199.199.0------R2

R1--199.199.199.1

R2--199.199.199.2

R1 is configured with " ntp server 199.199.199.2"

R2 is configured with " ntp master 7"

The first Ntp packet sent by R1 to R2 is  expanded below:

.     Time Source                Destination           Protocol Length Address Resolution Protocol Info

    104 394  199.199.199.1         199.199.199.2         NTP      90                                 NTP Version 3, client

    Reference Timestamp: Jan  1, 1970 00:00:00.000000000 UTC

    Origin Timestamp: Jan  1, 1970 00:00:00.000000000 UTC

    Receive Timestamp: Jan  1, 1970 00:00:00.000000000 UTC

    Transmit Timestamp: Mar  1, 2002 00:31:30.451929000 UTC

1) What is Origin timestamp?  Is it time ntp packet is created by R1?

2) What is Receive Time stamp? Is it the time ntp packet is received?

3)What is Transmit time stamp? Is it the time ntp packet is transmitted?

The R2 sends the response packet to R1 shown below:

No.     Time Source                Destination           Protocol Length Address Resolution Protocol Info

    105 394  199.199.199.2         199.199.199.1         NTP      90                                 NTP Version 3, server

    Reference ID: 127.127.7.1

    Reference Timestamp: Mar  1, 2002 00:30:28.791935000 UTC

    Origin Timestamp: Mar  1, 2002 00:31:30.451929000 UTC

    Receive Timestamp: Mar  1, 2002 00:31:30.168158000 UTC

    Transmit Timestamp: Mar  1, 2002 00:31:30.168168000 UTC

1) Receive timestamp above shows the time NTP request was received by R2 according to its local clock. Is it correct?

2) Origin time stamp above shows the time NTP response packet is created by R2 according to its clock. Is it correct?

3) Transmit timestamp above shows the time NTP response is transmitted by R2 according to its clock. Is it correct?

thanks and have a great weekend.

3 Accepted Solutions

Accepted Solutions

Peter Paluch
Cisco Employee
Cisco Employee

Hi Sarah,

First, let me quote from RFC 5905:

   Reference Timestamp: Time when the system clock was last set or
   corrected, in NTP timestamp format.

   Origin Timestamp (org): Time at the client when the request departed
   for the server, in NTP timestamp format.

   Receive Timestamp (rec): Time at the server when the request arrived
   from the client, in NTP timestamp format.

   Transmit Timestamp (xmt): Time at the server when the response left
   for the client, in NTP timestamp format.

   Destination Timestamp (dst): Time at the client when the reply
   arrived from the server, in NTP timestamp format.

Now, to your questions:

1) What is Origin timestamp?  Is it time ntp packet is created by R1?

Yes. It is most probably set to all zeros because the R1 does not consider its own time as being synchronized.

2) What is Receive Time stamp? Is it the time ntp packet is received?

Yes, but following the definition above, this field can be sensibly populated only by responses sent from the server.

3)What is Transmit time stamp? Is it the time ntp packet is transmitted?

Yes, but similarly to the previous question, this field is related to messages sent by server. The difference between Transmit and Receive timestamp represents the total processing delay at the NTP server. It is useful when determining the round trip delay between the client and server without the processing delay at the server.

1) Receive timestamp above shows the time NTP request was received by R2 according to its local clock. Is it correct?

Correct.

2) Origin time stamp above shows the time NTP response packet is created by R2 according to its clock. Is it correct?

Correct.

3) Transmit timestamp above shows the time NTP response is transmitted by R2 according to its clock. Is it correct?

Correct.

Best regards,

Peter

View solution in original post

Hello Sarah,

I noticed that regardless of time zone configured on a local router  serving as NTP master,  Ntp master router continues to use the  timestamps based on UTC co-ordinates

That is correct. The NTP always carries the time in UTC coordinates. The time is subsequently shifted on the local node according to the configured timezone.

Regardless of timezone configured, ntp server continue to  use  timestamps based on UTC co-ordinates.  Is that the reason why we have to  configure timezone on NTP client so it could adjust its clock because   ntp response packet carries timestamp based on UTC co-ordinates?

Is my observation correct ?

Yes, that is correct.

I want to thank you for helping me pass my CCNP route and Switch exam.

I am honored, Sarah. It is primarily and foremostly your own accomplishment and success. Heartfelt congratulations!

Best regards,

Peter

View solution in original post

Hello Sarah,

However, when I look at the very first ntp reqruest packet sent  by  R1(client) to R2 (sever/master), I notice " transmit" timestamp is  filled by R1 which is a ntp client.

You are right. I missed that. Hmmm - well, my personal opinion is that the Transmit timestamp in the client's message is perhaps not used by the server but may nevertheless be included.

Best regards,

Peter

View solution in original post

5 Replies 5

Peter Paluch
Cisco Employee
Cisco Employee

Hi Sarah,

First, let me quote from RFC 5905:

   Reference Timestamp: Time when the system clock was last set or
   corrected, in NTP timestamp format.

   Origin Timestamp (org): Time at the client when the request departed
   for the server, in NTP timestamp format.

   Receive Timestamp (rec): Time at the server when the request arrived
   from the client, in NTP timestamp format.

   Transmit Timestamp (xmt): Time at the server when the response left
   for the client, in NTP timestamp format.

   Destination Timestamp (dst): Time at the client when the reply
   arrived from the server, in NTP timestamp format.

Now, to your questions:

1) What is Origin timestamp?  Is it time ntp packet is created by R1?

Yes. It is most probably set to all zeros because the R1 does not consider its own time as being synchronized.

2) What is Receive Time stamp? Is it the time ntp packet is received?

Yes, but following the definition above, this field can be sensibly populated only by responses sent from the server.

3)What is Transmit time stamp? Is it the time ntp packet is transmitted?

Yes, but similarly to the previous question, this field is related to messages sent by server. The difference between Transmit and Receive timestamp represents the total processing delay at the NTP server. It is useful when determining the round trip delay between the client and server without the processing delay at the server.

1) Receive timestamp above shows the time NTP request was received by R2 according to its local clock. Is it correct?

Correct.

2) Origin time stamp above shows the time NTP response packet is created by R2 according to its clock. Is it correct?

Correct.

3) Transmit timestamp above shows the time NTP response is transmitted by R2 according to its clock. Is it correct?

Correct.

Best regards,

Peter

Thanks Peter.

I noticed that regardless of time zone configured on a local router serving as NTP master,  Ntp master router continues to use the timestamps based on UTC co-ordinates

For e.g

R1-------------------------R2

R1  199.199.199.1 ( NTP client)

R2   199.199.199.2 (NTP server/master)

R1 is configure with " NTP server 199.199.199.2

R2 is configured with " Ntp master 7"   ,  "

R2#show clock

*00:01:59.995 UTC Fri Mar 1 2002

Next I configure:

R2( config)# clock timezone UTC+6  6

R2#show clock

06:03:23.691 UTC+6 Fri Mar 1 2002

Notice that R2 adjusts its clock accordingly.

But when I look at the timestamps used by R2 when it sends ntp packet to R1, i notice R2 uses timestamp based on UTC co-ordinates as shown below:

No.     Time Source                Destination           Protocol Length Address Resolution Protocol Info

     17 6    199.199.199.2         199.199.199.1         NTP      90                                 NTP Version 3, server

    Reference ID: 127.127.7.1

    Reference Timestamp: Mar  1, 2002 00:03:26.776192000 UTC

    Origin Timestamp: Mar  1, 2002 00:04:13.014248000 UTC

    Receive Timestamp: Mar  1, 2002 00:04:13.112256000 UTC

    Transmit Timestamp: Mar  1, 2002 00:04:13.112266000 UTC

==============================================================================

Regardless of timezone configured, ntp server continue to  use timestamps based on UTC co-ordinates.  Is that the reason why we have to configure timezone on NTP client so it could adjust its clock because  ntp response packet carries timestamp based on UTC co-ordinates?

Is my observation correct ?

====================================================

I want to thank you for helping me pass my CCNP route and Switch exam.

Thanks and have a great weekend.

Hello Sarah,

I noticed that regardless of time zone configured on a local router  serving as NTP master,  Ntp master router continues to use the  timestamps based on UTC co-ordinates

That is correct. The NTP always carries the time in UTC coordinates. The time is subsequently shifted on the local node according to the configured timezone.

Regardless of timezone configured, ntp server continue to  use  timestamps based on UTC co-ordinates.  Is that the reason why we have to  configure timezone on NTP client so it could adjust its clock because   ntp response packet carries timestamp based on UTC co-ordinates?

Is my observation correct ?

Yes, that is correct.

I want to thank you for helping me pass my CCNP route and Switch exam.

I am honored, Sarah. It is primarily and foremostly your own accomplishment and success. Heartfelt congratulations!

Best regards,

Peter

Thanks for your kind words and humility.

Transmit Timestamp (xmt): Time at the server when the response left

   for the client, in NTP timestamp format.

    3)What is Transmit time stamp? Is it the time ntp packet is transmitted?

Yes, but similarly to the previous question, this field is related to messages sent by server. The difference between Transmit and Receive timestamp represents the total processing delay at the NTP server. It is useful when determining the round trip delay between the client and server without the processing delay at the server.

So far I have learned  " transmit" timestamp is filled by ntp server.  However, when I look at the very first ntp reqruest packet sent  by R1(client) to R2 (sever/master), I notice " transmit" timestamp is filled by R1 which is a ntp client.

The first Ntp packet sent by R1 to R2 is  expanded below:

.     Time Source                Destination           Protocol Length Address Resolution Protocol Info

    104 394  199.199.199.1         199.199.199.2         NTP      90                                 NTP Version 3, client

    Reference Timestamp: Jan  1, 1970 00:00:00.000000000 UTC

    Origin Timestamp: Jan  1, 1970 00:00:00.000000000 UTC

    Receive Timestamp: Jan  1, 1970 00:00:00.000000000 UTC

    Transmit Timestamp: Mar  1, 2002 00:31:30.451929000 UTC

Thanks and have a great evening ( I know it is evening there )

Hello Sarah,

However, when I look at the very first ntp reqruest packet sent  by  R1(client) to R2 (sever/master), I notice " transmit" timestamp is  filled by R1 which is a ntp client.

You are right. I missed that. Hmmm - well, my personal opinion is that the Transmit timestamp in the client's message is perhaps not used by the server but may nevertheless be included.

Best regards,

Peter

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: