What Is NTP?
NTP (Network Time Protocol) keeps every device clock synchronised over UDP port 123. Devices sync from servers arranged in stratum levels — stratum 0 is the reference clock itself, stratum 1 servers attach to it, and each hop away adds one.
The stratum hierarchy
| Stratum | What it is |
|---|---|
| 0 | The reference clock itself — GPS or atomic; not on the network |
| 1 | Servers directly attached to a stratum-0 clock |
| 2 | Servers syncing from stratum 1 — where most enterprises sit |
| 3–15 | Each additional hop; higher = further from the source |
| 16 | Unsynchronised — considered invalid |
A lower stratum means closer to the truth, not necessarily a better server for you — a stable, nearby stratum-2 beats a distant stratum-1.
Why time sync actually matters
- Log correlation — incident timelines across devices only line up if clocks agree; syslog without NTP is guesswork.
- Security protocols break — certificate validation and Kerberos are time-sensitive; minutes of drift cause authentication failures.
- Compliance and forensics — evidence needs trustworthy timestamps.
Configuring and verifying on Cisco
ntp server 192.168.1.1 ! or a public pool server show ntp status ! synchronised? stratum? show ntp associations ! which servers, offsets
Sync can take several minutes — do not panic-troubleshoot immediately. Authenticate NTP where spoofed time would matter (walkthrough: NTP authentication lab).
Frequently asked questions
What is NTP used for?
Synchronising device clocks across a network (UDP port 123), so logs correlate, certificates validate, and time-sensitive authentication like Kerberos works.
What does stratum mean in NTP?
Distance from the reference clock. Stratum 0 is the clock itself (GPS/atomic), stratum 1 servers attach to it, and each hop away adds one. Stratum 16 means unsynchronised.
Why is time synchronisation important for security?
Certificate validation and Kerberos authentication depend on accurate time, and incident investigation requires logs from different devices to share one timeline.
How do I check NTP on a Cisco device?
show ntp status shows whether the clock is synchronised and at what stratum; show ntp associations lists the servers being used and their offsets.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.