Appendix A. NTP Data Format - Version 3
This appendix describes the NTP message format, which follows the IP and UDP headers. The format is identical to that described in RFC-1119 with the exception of the Reference Identifier field described below. For the benefit of implementors the format is shown below.
NTP Message Header
The NTP message is a UDP datagram with the following header format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|LI | VN |Mode | Stratum | Poll | Precision |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Root Delay |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Root Dispersion |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reference Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Reference Timestamp (64) +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Originate Timestamp (64) +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Receive Timestamp (64) +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Transmit Timestamp (64) +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Key Identifier (optional) (32) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| |
| Message Digest (optional) (128) |
| |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Field Descriptions
Leap Indicator (LI): This is a two-bit code warning of an impending leap second to be inserted/deleted in the last minute of the current day, with bit 0 and bit 1, respectively, coded as follows:
| Value | Meaning |
|---|---|
| 00 | no warning |
| 01 | last minute has 61 seconds |
| 10 | last minute has 59 seconds |
| 11 | alarm condition (clock not synchronized) |
Version Number (VN): This is a three-bit integer indicating the NTP version number. The version number is 3 for Version 3 (IPv4 only) and 4 for Version 4 (IPv4, IPv6 and OSI).
Mode: This is a three-bit integer indicating the mode, with values defined as follows:
| Value | Meaning |
|---|---|
| 0 | reserved |
| 1 | symmetric active |
| 2 | symmetric passive |
| 3 | client |
| 4 | server |
| 5 | broadcast |
| 6 | reserved for NTP control message |
| 7 | reserved for private use |
Stratum: This is an eight-bit unsigned integer indicating the stratum level of the local clock, with values defined as follows:
| Value | Meaning |
|---|---|
| 0 | unspecified or unavailable |
| 1 | primary reference (e.g., radio clock) |
| 2-15 | secondary reference (via NTP or SNTP) |
| 16-255 | reserved |
Poll Interval: This is an eight-bit signed integer indicating the maximum interval between successive messages, in seconds to the nearest power of two. The values that can appear in this field presently range from 4 (16 s) to 14 (16384 s); however, most applications use only the sub-range 6 (64 s) to 10 (1024 s).
Precision: This is an eight-bit signed integer indicating the precision of the local clock, in seconds to the nearest power of two. The values that normally appear in this field range from -6 for mains-frequency clocks to -20 for microsecond clocks found in some workstations.
Root Delay: This is a 32-bit signed fixed-point number indicating the total roundtrip delay to the primary reference source, in seconds with fraction point between bits 15 and 16. Note that this variable can take on both positive and negative values, depending on the relative time and frequency offsets. The values that normally appear in this field range from negative values of a few milliseconds to positive values of several hundred milliseconds.
Root Dispersion: This is a 32-bit unsigned fixed-point number indicating the nominal error relative to the primary reference source, in seconds with fraction point between bits 15 and 16. The values that normally appear in this field range from 0 to several hundred milliseconds.
Reference Identifier: This is a 32-bit bitstring identifying the particular reference source. In the case of NTP Version 3, this is a four-character ASCII string, left justified and zero padded to 32 bits. In NTP Version 3, the following ASCII strings are defined:
| String | Source |
|---|---|
| DCN | DCN routing protocol |
| NIST | NIST public modem |
| TSP | TSP time protocol |
| DTS | Digital Time Service |
| ATOM | Atomic clock (calibrated) |
| VLF | VLF radio (OMEGA, etc.) |
| GPS | GPS satellite receiver |
| GOES | GOES UHF environment satellite |
| WWV | WWV HF radio |
| WWVB | WWVB LF radio |
| WWVH | WWVH HF radio |
| CHU | CHU HF radio |
| LORC | LORAN-C radionavigation system |
| OMEG | OMEGA radionavigation system |
| TDF | TDF HF radio (France) |
In NTP Version 4 primary servers, this is a four-octet IPv4 address or the first four octets of the MD5 hash of the IPv6 address. In NTP Version 4 secondary servers, this is the reference identifier of its synchronization source.
Reference, Originate, Receive and Transmit Timestamps: These four fields are in the format of the NTP timestamp, which is a 64-bit unsigned fixed-point number with the integer part in the first 32 bits and the fraction part in the last 32 bits. This format allows convenient multiple-precision arithmetic and conversion to Time Protocol representation (seconds), but does complicate the conversion to ICMP Timestamp message representation (milliseconds). The precision of this representation is about 200 picoseconds, which should be adequate for even the most exotic requirements.
Authenticator (optional): When the NTP authentication scheme is implemented, the Key Identifier and Message Digest fields contain the message authentication code (MAC) information defined in Appendix C.