PTP, NTP, and Why a Clock Breaks Authentication First

The acronymPTP means three things, and two of them are not this

Worth settling first, because the acronym is genuinely ambiguous and a search for it returns all three.

Precision Time Protocol is the networking one and the subject of this page.

Picture Transfer Protocol is how a camera presents itself over USB, which is why a camera menu offers a choice between PTP and mass storage. Nothing to do with clocks.

Point to point is written PTP in wireless and carrier documents, describing a link between exactly two endpoints rather than a shared medium.

Only the first is IEEE 1588. If a document mentions a grandmaster, a boundary clock or nanoseconds, it is the time protocol. If it mentions a camera or a radio, it is not.

The mechanismHow PTP measures the delay

Both time protocols answer the same question, what time is it, and both work by measuring the network delay of a message and correcting for it. The difference is where the timestamp is taken.

NTP timestamps in software. A packet arrives, the operating system gets to it when it gets to it, and the queueing, the interrupt and the scheduler all add microseconds to milliseconds of uncertainty to the measured time that no arithmetic can remove.

PTP pushes the timestamp down toward the wire and asks the network hardware to help. Its transparent clocks, added in the 2008 version of the standard, are switches that modify a PTP message as it passes to record how long it spent inside them, so the network delay of the path is measured rather than estimated.

That is the whole trick, and it is why PTP needs switch support to reach its precision rather than merely tolerating whatever the network does.

The four messages, and what each one is for

The measurement is an exchange of PTP messages between a master and a slave rather than a broadcast, which is the part that makes the network delay knowable. Ordinary and boundary clocks use four message types for clock synchronization, and they run on UDP ports 319 and 320.

Read the second row. Follow_Up exists because a device cannot always know its own send time at the instant it sends, so PTP lets it report that timestamp afterward rather than guess in advance. Transparent clocks add their own pair, Pdelay_Req and Pdelay_Resp, to measure the delay of each individual link.

With the four timestamps, the slave has both the one way network delay and its own time offset from the master, and it corrects for both. NTP performs the same arithmetic; what differs is how honest the timestamps going into it are.

A slave also uses consecutive Sync messages to match the frequency of the master, which the standard calls syntonization. Synchronization proper is the offset correction, and an accurate result depends on both, because a clock synchronized once and left alone drifts again.

Clock typesPTP clocks: master, slave, boundary and transparent

The Precision Time Protocol arranges the devices on a network into a master and slave hierarchy. A master port sends time, a slave port receives it, and IEEE 1588 defines a small set of clock types by which of those roles a device can take.

• Ordinary clock. A device with one PTP port. It is either the master for its segment or a slave. Most end devices, such as servers, cameras and controllers, are ordinary clocks acting as slaves.
• Grandmaster. The master at the top of the hierarchy, normally disciplined by a GPS or other satellite receiver. Every other clock in the system traces its time to it.
• Boundary clock. A switch or router with several PTP ports. It is a slave to the upstream master on one port and a master to the devices on its other ports, so the grandmaster does not answer every slave itself.
• Transparent clock. A switch that stays out of the hierarchy. It forwards PTP messages and writes the time each one spent inside it into a correction field.

How the grandmaster is chosen

In a default deployment nobody picks the master by hand. Every clock able to be a master sends Announce messages describing itself, and the best master clock algorithm (BMCA) on each device compares them in a fixed order: priority1, clock class, clock accuracy, clock variance, priority2, and last the clock identity as a tie break.

The best clock becomes the grandmaster and the rest become slaves or stay passive. The algorithm runs all the time, so when the grandmaster fails or loses its GPS reference, the next best master takes over without an operator. The two priority values are how an administrator overrides the result.

A PTP domain is a number carried in every message. Clocks ignore messages from other domains, so two independent PTP systems can share one network. The master and slave wording is the standard's own, and IEEE lists an amendment, IEEE 1588g-2022, that identifies optional alternative terms for both.

ProfilesPTP profiles, transport and timestamping options

IEEE 1588 leaves many options open, and a PTP system only synchronizes when every device is set to the same ones. Four choices matter, and a profile is the way an industry fixes them.

Transport. PTP messages travel either directly in Ethernet frames at Layer 2, with Ethertype 0x88F7, or over UDP on IPv4 or IPv6 at Layer 3. Multicast is the default. Unicast is an option, and some profiles require it.

One step or two step. A one step master writes the precise timestamp into the Sync message as it leaves the port. A two step master sends the Sync first and the timestamp afterward in a Follow_Up. The accuracy is the same, but one step needs hardware able to edit the frame on the fly.

Delay mechanism. End to end (E2E) measures the delay between slave and master with Delay_Req and Delay_Resp. Peer to peer (P2P) has every device measure the delay to its neighbor with the Pdelay messages, which only works when every switch in the path supports PTP.

Hardware timestamping. The network adapter or switch port stamps each message in hardware. On Linux that clock appears as a PTP hardware clock (PHC), which the ptp4l daemon synchronizes to the master and phc2sys copies to the system clock. Software based timestamping also works, with accuracy closer to NTP.

Profiles. A PTP profile is a named set of those choices, with message rates and allowed clock types, so devices from different vendors interoperate in one kind of application.

Why it mattersWhy the clock breaks authentication first

Here is the part that makes time an operations topic rather than a curiosity.

Kerberos, which is what a Windows domain uses to authenticate, puts timestamps inside its tickets deliberately: Microsoft describes the mechanism as preventing replay attacks, where a captured credential is submitted again later.

A timestamp only works for that if both ends agree what the time is, so the protocol sets a tolerance and refuses anything outside it. Time synchronization is therefore a dependency of authentication rather than a convenience.

That tolerance is a policy called Maximum tolerance for computer clock synchronization, and its default in the Default Domain Policy is five minutes. Microsoft's own recommendation is to leave it at five. Past that, tickets are refused.

The symptom is the problem. A machine whose clock has drifted six minutes does not report a clock error. It reports that the password is wrong, or that the domain is unavailable, or that a mapped drive will not connect, and somebody spends an hour on the account before anybody types w32tm /query /status.

Three more things break in the same quiet way.

Certificate validation. A certificate is valid between two instants. A client whose clock is wrong by enough will reject a perfectly good certificate as not yet valid or expired, and the browser message blames the site.

Log correlation. An incident timeline assembled from three servers with three different ideas of the time is not a timeline. This is the failure that costs the most and is noticed the latest, because nothing looks broken until somebody needs the logs.

Anything scheduled. Backups, certificate renewal, token expiry and maintenance windows all run against a clock that everybody assumed was right.

On WindowsWhat a Windows domain actually does

Worth knowing precisely, because the common fix makes it worse.

Domain-joined machines default to a client type Microsoft calls NT5DS, which means they take the time from the domain hierarchy rather than from the internet.

Each machine synchronizes from a domain controller, and the domain controller holding the PDC emulator role in the root forest domain is the one configured to synchronize with an external time source. W32Time follows the NTP standard and uses UDP port 123 in both directions.

So the correct fix for a drifting domain is to point the PDC emulator at a good external time source and let the hierarchy distribute it. The common wrong fix is to point every machine on the network at an internet time server individually, which breaks the hierarchy and produces a domain whose members disagree with their own domain controllers.

Two defaults are worth having in your head. MaxAllowedPhaseOffset is 300 seconds on a domain member, meaning an offset under five minutes is corrected gradually and anything larger is set immediately.

And a domain controller will refuse a correction larger than MaxNegPhaseCorrection, which defaults to 172,800 seconds, or 48 hours, logging an event instead of jumping the clock. A machine that has been off for a week will therefore sit there being wrong and telling you about it in the event log.

The commands worth knowing are short: w32tm /query /status /verbose for the current offset, stratum and source, w32tm /stripchart /computer: to watch the offset against another machine, and w32tm /resync to force one.

The decisionWhich one you need

PitfallsWhere people go wrong

Treating the clock as cosmetic. Time synchronization is an authentication dependency. Five minutes of drift on a domain member is an outage that presents itself as a password problem.

Pointing every machine at the internet. Domain members should take time from the domain hierarchy. Only the PDC emulator needs an external source, and overriding that on clients is the most common self-inflicted time fault there is.

Buying PTP for an office. Sub-microsecond precision costs network hardware support and design effort. Nothing in a normal business network is measured to a microsecond.

Assuming a virtual machine is fine. A guest clock can be driven by the hypervisor, by the guest operating system, or by both fighting. Decide which, deliberately, and check that the domain hierarchy is not being overridden by the host.

Ignoring the event log after a long outage. A machine off for a week can exceed the correction limit and refuse to fix itself, sitting there wrong and saying so where nobody is looking.

Confusing the acronym. PTP on a camera is Picture Transfer Protocol and PTP on a radio link is point to point. Neither is IEEE 1588.

ComparisonNTP and PTP, side by side

The bottom two rows decide it for almost every reader. PTP is a specialist tool for networks where a microsecond is a business requirement, and buying it because more precision sounds better is buying switches to solve a problem nobody had.

FAQFrequently asked questions

Keep readingRelated concepts

Read next · Directory and identity Active Directory Explained The hierarchy the time actually comes from on a Windows network, and why pointing clients at the internet breaks it. Open this next15 min

• Ports · 10 min Port 88, and Why a Domain Stops Working Without It The port the refused tickets travel on, and the other way a domain stops authenticating when a firewall is in the way.
• Diagnostics · 12 min Reading a Wireshark Capture Without Drowning in Packets What to do when the timestamps in two captures disagree, which is the same problem one layer further along.
• Network services · 9 min NTP Stratum, How Far a Server Is From the Clock The tighter-timing alternative to NTP and its stratum hierarchy.