What an NTP security test shows
Field by field, and its limits
Every field our validator reads, what it means, the RFC behind it — and, just as important, what a remote measurement cannot tell you.
1. What a remote test observes
Our validator behaves as an ordinary NTP/NTS client (RFC 5905, RFC 8915) and reads only what any client reads. Below is each field, what it means, and the reference behind it. On a proven-owned address it also runs the amplification hardening check.
2. Field by field
| Field | What it means | Reference |
|---|---|---|
| Version & mode | Protocol version and packet mode (a server answers in mode 4). An unexpected mode, or answers to mode 6/7 control queries, is a security signal. | RFC 5905 §7.3 |
| Stratum | Distance from the reference clock: 1 = directly attached, 2 = one hop, 16 = unsynchronised. Lower is theoretically closer to the source, not more trustworthy — stratum is self-declared. | RFC 5905 §3 |
| Leap indicator (LI) | 0 = normal, 1/2 = a leap second announced tonight, 3 = the server declares itself unsynchronised. LI 3 means do not trust its time. | RFC 5905 §7.3 |
| Reference ID (refid) | What the server syncs to: an ASCII clock code at stratum 1 (GPS, PPS…), or, at stratum ≥ 2, the IPv4 address of its upstream — or a 4-byte hash of an IPv6 address that looks like an IPv4 and cannot be reversed. | RFC 5905 §7.3 |
| Offset & round-trip | Offset = the clock difference between the target and our reference at the same instant; round-trip = the network time there and back. Offset is only meaningful to ±(round-trip)/2 — we always show that uncertainty. | RFC 5905 §8 |
| Root delay / root dispersion | The total delay and accumulated error up to the reference clock, as the server itself reports them. Large values mean a distant or uncertain source. | RFC 5905 §7.3 |
| NTS-KE handshake, identity, certificate | Whether authenticated time is obtained; whether the TLS certificate is valid for the exact name queried (not just any name); and how many days it has left. Authenticated time under the wrong name is flagged, not counted as OK. | RFC 8915 |
| Kiss-o'-Death | A stratum-0 answer is a KoD, a refusal — a rate-limit or access denial, not a measurement. We treat it as "no answer", never as time. | RFC 5905 §7.4 |
| Amplification / hardening | Whether a legacy control query draws a reply larger than the request (real amplification, received > sent). Only on a proven-owned address. | — |
3. What the test cannot conclude
- It is remote. Offset is measured against our stratum-2 reference and over the Internet — good to a few milliseconds, not to the microsecond, and not against UTC directly.
- One vantage point. A single measurement from our server, at one instant, is a snapshot — not availability over time, and not what a client elsewhere would see.
- Your systems are out of view. That a source is healthy says nothing about whether your machines use it, whether their settings are protected, or whether synchronisation is monitored.
- Not a certification. No result here proves compliance with any framework — see what each one actually requires. For continuous, dated, sealed evidence — monitoring over time rather than a snapshot — that is a different job, not a free tool.
Frequently asked questions
Does a low stratum mean a server is more secure?
No. Stratum measures distance from the reference clock, not integrity, and it is self-declared — an attacker can announce stratum 1 while serving forged time. Authentication (NTS), not stratum, is what makes time trustworthy.
What does the reference ID (refid) tell me?
At stratum 1 it is an ASCII code for the reference clock (GPS, PPS…). At stratum 2 or more it is the IPv4 address of the server's upstream, or a 4-byte hash of an IPv6 address that looks like an IPv4 and cannot be reversed. It is the raw value the server announces; we do not attribute it to any named operator.
Why is the offset shown with a ± uncertainty?
A measurement over the Internet cannot know how the round-trip delay splits between the outbound and return paths, so the true offset is only known to about ±(round-trip)/2. Showing a bare "0.3 ms" without that band would read as a precision the measurement does not have.
Can this test prove my organisation is compliant?
No. It is one measurement from one vantage point, against our reference and not UTC. It shows what a source serves, not whether your systems synchronise to it, are monitored, or meet a given framework. Treat it as evidence to collect, not a certificate.