NTP
Network Time ProtocolNTP keeps networked machines closely aligned on time. It measures the round trip to a reference clock and works out the offset, then steers the local clock towards it rather than jumping — because certificates, logs, Kerberos and TOTP all fall apart without it.
NTP works out the offset between two clocks by timing a round trip — then disciplines the local one towards its selected time sources.
How it works
The arithmetic assumes the path is symmetric in each direction — which is why an asymmetric route quietly costs accuracy. Polling several servers lets a client discard the one that disagrees with the rest.
What NTP does, step by step
The client records when it sent the request; the server records arrival and departure and returns all three.
Four timestamps give both the round-trip delay and how far the local clock is out.
Several servers are polled; outliers are rejected and the best-agreeing set is combined.
Small errors are corrected by slewing the clock’s rate; only a large one is stepped outright.
In cybersecurity
Time underpins certificate validity, log correlation, Kerberos and one-time codes — so an attacker who can move your clock can break all of them at once.
The old monlist command returned huge replies to tiny spoofed queries — a classic DDoS vector.
Push a clock forward and expired certificates become valid; push it back and revocation is undone.
Network Time Security authenticates the server, closing the gap plain NTP leaves wide open.
Multiple independent servers let the client outvote one that has been tampered with.
Answer queries, but disable remote configuration and status commands entirely.
Five minutes of skew and domain authentication simply stops working.