1482 IEEE TRANSACTIONS ON COMMUNICATIONS, VOL. 39, NO. 10, OCTOBER 1991 Internet Time Synchronization: The Network Time Protocol David L. Mills, Member, IEEE Abstruct- This paper describes the network time protocol a similar number of gateways. In this paper the capitalized (NTP),which is designed to distribute time information in a large, Internet refers to this particular system, while the uncapitalized diverse internet system operating at speeds from mundane to internet refers to any generic system of multiple networks lightwave. It uses a symmetric architecture in which a distributed subnet of time servers operating in a self-organizing, hierarchical interconnected by gateways. While the Internet backbone configuration synchronizes local clocks within the subnet and networks and gateways are carefully engineered for good to national time standards via wire, radio, or calibrated atomic service, operating speeds, and service reliability vary consid- clock. The servers can also redistribute time information within erably throughout the system. This places severe demands a network via local routing algorithms and time daemons. on NTP, which must deliver accurate and reliable time in This paper also discusses the architecture, protocol and algo- rithms, which were developed over several years of implementa- spite of component failures, service disruptions and possibly tion refinement and resulted in the designation of NTP as an mis-engineered implementations. Internet Standard protocol. The NTP synchronization system, In the remainder of this introductory Section I, issues in which has been in regular operation in the Internet for the the requirements, approaches, and comparisons with previ- last several years, is described along with performance data ous work are discussed. The architecture of the NTP syn- which shows that timekeeping accuracy throughout most portions of the Internet can be ordinarily maintained to within a few chronization system, including the primary reference sources milliseconds, even in cases of failure or disruption of clocks, time and distribution mechanisms, is described in Section 11. An servers or networks. overview of the NTP protocol and modes of operation is given in Section 111. Section IV describes the algorithms used to im- prove the accuracy of measurements made over Internet paths I. INTRODUCTION and to select the best from among a set of available clocks CCURA", reliable time is necessary for financial and for synchronization. Section V describes a local-clock design Alegal transactions, transportation and distribution systems based on a type of phase-lock loop and capable of long-term and many other applications involving widely distributed accuracies to the order of a few milliseconds. The international resources. How do hosts in a large, dispersed networking com- NTP synchronization system of time servers now operating munity know what time it is? How accurate are their clocks? In in the Internet is described and its performance assessed in a recent survey involving 94 260 hosts of the Internet system, Section VI. Section VI1 discusses further development and 20 758 provided local time using three time-transfer protocols issues for future research. This paper itself is an updated and [24]. About half of the replies had errors greater than 2 min, condensed version of [23]. while 10% had errors greater than 4 h. A few had errors over two weeks. Most local clocks are set by eyeball-and- A. Definitions wristwatch to within a minute or two and rarely checked after In this paper, the stability of a clock is how well it can that. Many of these are maintained by some sort of battery- maintain a constant frequency, the accuracy is how well its backed clock-calendar device using a room-temperature quartz time compares to national standards and the precision is how oscillator that may drift as much as a second per day and precisely time can be resolved in a particular timekeeping can go for weeks between manual corrections. For many system. The offset of two clocks is the time difference between applications, especially distributed internet applications, much them, while the skew is the frequency difference between them. greater accuracy and reliability is required. The reliability of a timekeeping system is the fraction of the This paper presents an overview of the architecture, protocol time it can be kept operating and connected in the network and algorithms of the network time protocol (NTP) used (without respect to stability and accuracy). Local clocks are in the Internet system to synchronize clocks and coordinate maintained at designated time servers, which are timekeeping time distribution. The Internet consists of over 100000 hosts systems belonging to a synchronization subnet, in which each on over 1500 packet-switching networks interconnected by server measures the offsets between its local clock and the clocks of its neighbor servers or peers in the subnet. In this Paper approved by the Editor for Network Protocols of the IEEE Communi- paper to synchronizefrequency means to adjust the clocks in cations Society. Manuscript received February 10, 1989; revised January 29, 1990 and July 18, 1990. This work was supported in part by the Defense the subnet to run at the same frequency, to synchronize time Advanced Research Projects Agency under Contract N00140-87-C-8901 and means to set them to agree at a particular epoch with respect by the National Science Foundation under Grant NCR-89-13623. to coordinated universal time (UTC), as provided by national The author is with the Department of Electrical Engineering, University of Delaware, Newark, DE 19716. standards, and to synchronize clocks means to synchronize IEEE Log Number 9101515. them in both frequency and time. 009&6778/91$01.00 0 1991 IEEE MILLS: INTERNET TIME SYNCHRONIZATION 1483 B. Performance Requirements radio services with a UTC timecode modulation which can Internet transmission paths can have wide variation in delay be decoded by suitable receivers. One approach to time and reliability due to traffic load, route selection, and facil- synchronization is to provide timecode receivers at every ity outages. Stable frequency synchronization requires stable site where required. However, these receivers are specialized, local-clock oscillators and multiple offset comparisons over moderately expensive and subject to occasional gross errors relatively long periods of time, while reliable time synchro- due to propagation and equipment failures. A comprehensive nization requires carefully engineered selection algorithms and summary of radio synchronization techniques can be found in the use of redundant resources and diverse transmission paths. [41. For instance, while only a few offset comparisons are usually The U.S. National Institute of Standards and Technology adequate to determine local time in the Internet to within a (NIST) (formerly National Bureau of Standards), recently few tens of milliseconds, dozens of measurements over some announced a computer time service available to the general days are required to reliably stabilize frequency to a few public by means of a standard telephone modem [26]. The milliseconds per day. Thus, the performance requirements of service is intended for use by personal workstations to set an intemet-based time synchronization system are particularly clock-calendars, for example, but would not be suitable for a demanding. A basic set of requirements must include the large population of clients calling on a frequent, regular basis following. without further redistribution. 1) The primary reference source(s) must be synchronized to In principle, it is possible to use special network facilities national standards by wire, radio, or calibrated atomic clock. designed for time synchronization, such as timecode rebroad- The time servers must deliver continuous local time based casts on a dedicated FM or TV subcarrier or cable system. on UTC, even when leap seconds are inserted in the UTC For many years AT&T has synchronized digital switching timescale. equipment to the basic synchronization reference frequency 2) The time servers must provide accurate and precise time, (BSRF), which consists of a master oscillator synchronized to even with relatively large delay variations on the transmission UTC and a network of dedicated 2048-kHz links embedded in paths. This requires careful design of the filtering and com- the transmission plant. AT&T and other carriers are planning bining algorithms, as well as an extremely stable local-clock to use the global positioning system and the LORAN-C radio oscillator and synchronization mechanism. navigation system to synchronize switches in various areas 3) The synchronization subnet must be reliable and sur- of the country. However, neither of these methods would be vivable, even under unstable network conditions and where economically viable for widespread deployment in a large, connectivity may be lost for periods up to days. This requires diverse internet system. redundant time servers and diverse transmission paths, as well Current network clock synchronization techniques have as a dynamically reconfigurable subnet architecture. evolved from both linear systems and Byzantine agreement 4) The synchronization protocol must operate continuously methodologies. Linear methods for digital telephone network and provide update information at rates sufficient to compen- synchronization are summarized in [ 161, while Byzantine sate for the expected wander of the room-temperature