In this lesson, we're going to talk
about the network time protocol.
The network time protocol, also known as NTP,
is a networking protocol that's used for the synchronization
of clocks between different computer systems
that communicate over a packet-switched.
Variable-latency data network.
TCIPIP networks are considered packet-switch networks.
So network time protocol is going to be used
for the synchronization of time
across our IP connected servers.
Now, NTP is a really old protocol.
In fact, it's one of the older internet protocols
that's still commonly used today.
NTP sends out its data using UDP packets using port 123.
The most current version of NTP is NTP version four,
which was released back in 2010.
Now, NTP is really important in our computer network
because it ensures we're all using the exact same time.
In fact, NTP is designed
to synchronize the clocks on all participating computers
to within a few milliseconds of the UTC
or coordinated universal time.
Now, you can have an internal NTP server
within your network, which is usually going to be more accurate
within a few milliseconds,
or you can use an external NTP server
that is publicly available on the internet,
but this will only be accurate to within about tens
of milliseconds instead.
Now, the reason that using NTP is so important is that many
of our security protocols will rely on reliable time
for things to work properly.
For example, if the time between your workstation
and your server are off by more than about five minutes,
you can get an error that prevents you from even logging
into that domain controller.
So, how does NTP work?
Well, to learn how it works, we need
to talk about three different components, the stratum,
the clients, and the servers.
NTP is designed to use a hierarchical,
semi-layered system of time sources.
Each layer in this hierarchy is known as a stratum.
As of most things in computers,
we start counting out our stratum by beginning with one
and then incrementing upward by one each time
as we go further down the hierarchy.
So if you're in stratum zero,
this is going to be the most precise timekeeping devices
that we have access to,
which includes things like the atomic clock, GPS,
and other very accurate devices
that generate a pulse per second as a trigger to interrupt
and create a timestamp on a connected computer.
These stratum zero clocks are known as our reference clocks.
It's really important to note
that an NTP server cannot be considered themselves
to be at stratum zero,
and they must use one of these reference clocks instead.
So the first NTP servers we have in our hierarchy
are going to start at stratum one,
which is any computer whose system time is synchronized
to within a few microseconds
of an attached Stratum zero device.
To verify their time.
These stratum one servers can also pair
with other stratum one servers to verify they are accurate.
These Stratum one servers are known
as the primary time servers.
Our next set of NTP servers we have
are known as Stratum two.
A Stratum two server is connected
and synchronized to a stratum one server.
Often, a Stratum two server is going to be configured
to query multiple stratum one servers
to ensure it always has a stable
and robust time to provide to the other devices
inside of its pure group.
The next level we move into is Stratum three
and Stratum three servers are going to be synchronized upward
back to those Stratum two servers.
This pattern continues with stratum four, connecting back
to Stratum three, and so on.
Each time though, we're going to add a little bit more delay,
and this becomes further
and further from stratum zero, which had
that precise time from the atomic clock
or GPS that we began with.
Now, there is a limit to how many layers
or stratum we can actually use in NTP, and that limit is 15.
Now, if something is classified as stratum 16,
this indicates that that device is truly unsynchronized
according to the algorithm and the protocol.
Now, what does all this look like if you're going to use it
inside your enterprise networks?
Well, normally, you're going to connect a time server
to your network, or you'll run a time service on something
like your domain controller
with a dedicated hardware reference clock.
This will be at one of the stratum levels
that we just discussed, depending on
how far away from stratum zero,
that precise time source you actually are.
Then you'll install a piece of client software
on each workstation to interface with your server.
If you're using the Windows operating system,
it already has this functionality built into all
of its workstations, and your domain controller will run
the NTP service to act as the time source at one
of those stratum levels for all of your workstations.
Now, as I mentioned before, NTP is a very old protocol,
and it was first developed all the way back in the 1980s.
But there are two newer protocols that we can also use
to coordinate time on our systems,
and these help fix some of the weaknesses in NTP.
These two protocols are known as the precision time protocol
and the network time security protocol.
First, we have the Precision Time Protocol.
The Precision Time Protocol, also known as PTP,
is a protocol used to synchronize clocks
throughout a computer network. On a local area network.
It's going to achieve clock accuracy
in the sub-microsecond range,
which really makes this significantly more accurate
than the older NTP was for our systems.
The precision time protocol is ideal for networks
that require precise timekeeping such
as those in financial trading systems
or industrial automation systems.
The precision time protocol
operates using a primary-secondary architecture
for clock synchronization.
The primary clock will send precise time messages
and the secondary clocks will adjust themselves to align
with the primary clock by considering factors
like the message transmission times, and network delays.
Second, we have the network time security protocol.
Now, the network time security protocol, also known
as the NTS, is actually an extension
of the older NTP protocol that we talked about before,
and it was developed to provide cryptographic security
for the time synchronization
that's being provided by those NTP servers.
As NTP has been known to be vulnerable to various types
of attack, including on path attacks.
The network time security protocol was developed
to add a layer of security by authenticating the time source
and the integrity of the time
that's being received from that server.
Now, the network time security protocol is going to use
a combination of the transport layer security
or TLS as well as the authenticated encryption
with associated data or AEAD to ensure
that the time synchronization process is really secure
and that the time source is authenticated in order
to prevent malicious tampering with our time information.
So remember, while the network time protocol
is an essential protocol for synchronizing
the time across multiple computer systems in a network,
it is not the only tool we have
in our timekeeping toolbox.
As our networks grow and our needs for precision
and security evolve, we had to add new protocols like PTP
and NTS to be able
to provide enhanced accuracy and security.
Precision Time Protocol
offers a higher precision timekeeping solution for scenarios
where every microsecond is going to count,
and the network time security protocol ensures
that our time synchronization processes are secure
for malicious interference.
By understanding and leveraging these protocols
more effectively, we can maintain precise
and secure timekeeping across all of our network systems
to ensure that everything from security protocols
and transaction logging all the way over
to system troubleshooting and network optimization
are all occurring using the proper network time.