Understand ntpq command output in simple words

In this post, we will understand ntpq command output in detail. NTP (network time protocol) is a protocol that is used to synchronize time on computers, and devices. In an operating system like Ubuntu, we can use ntpq to synchronize the time. NTPQ configuration is kept in file/etc/ntp.conf file.

There are two ways to get the output of the NTP status on the system. In this post, we have kept the output of both commands. The output of both commands is the same.

• peer
• ntpq -p

Understand ntpq command output – Explanation

To understand ntpq command output we have run the command “ntpq -p” on the Ubuntu/linux machine, alternatively, we can run the peer argument to get the details. We have got the below output when running the command on the system.

remote – IP address or hostname of the servers specified in the configuration file, from which your host will synchronize time
(* System synchronized its time with this server.)

Meaning of character that prefix the remote hostname/IP address:

* indicates the current synchronization source.
# indicates that the host is selected, but distance from the host to the server exceeds the maximum value.
o indicates that the host is selected and the PPS signal is in use.
+ Peer selected for possible synchronization
x indicates that the host is the designated false ticker by the intersection algorithm.
. indicates that the host is selected from the end of the candidate list.
– indicates a discarded host.
blank indicates a host is discarded due to high stratum and/or failed sanity checks.
~ Peer is statically configured.

refid (Reference ID) – Where or what the remote peer or server is itself synchronized to.

st (stratum): The devices which are considered independent time sources are classified as stratum 0 sources; the servers directly connected to stratum 0 devices are classified as stratum 1 sources; servers connected to stratum 1 sources are then classified as stratum 2 sources and so on. Stratum 16 indicates an unsynchronized state of the machine with the particular server. A machine that has just started up will initially be at Stratum 16 until it synchronizes its clock with an NTP server.

t – Type of server.

 u: unicast or anycast client, 
 b: broadcast or multicast client, 
 l: local reference clock, 
 s: symmetric peer, 
 A: anycast server, 
 B: broadcast server, 
 M: multicast server

when: Number of seconds passed since last response.

poll: Poll interval in seconds. NTP Client sends NTP packets at intervals ranging from 8 s to 36 hr.

reach: The reach peer variable is an 8-bit shift register displayed in octal format. When a valid packet is received, the rightmost bit is lit. When a packet is sent, the register is shifted left one bit with 0 replacing the rightmost bit. If the reach value is nonzero, the server is reachable; otherwise, it is unreachable.

delay: The round-trip delay to peer is reported in milliseconds.

offset: Offset is the time difference in milliseconds between the peers or between the server and client.

jitter: Indicates the difference in the offset measurement between two samples. Jitter is a primary measure of the network service quality.

Understand ntpq command output – Troubleshooting

In case the time on the system is not correct. Check if the system is able to sync its time to any of the configured servers using the command “ntpq -p“, if the output of the command shows “ntpq: read: Connection refused” check the status of NTP service using the command “service ntp status” it should be in active state. Service can be force started using the command “sudo service ntp start“

lab@virtual-machine:~$ service ntp status
 ntp.service - Network Time Service
     Loaded: loaded (/lib/systemd/system/ntp.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2024-08-15 11:23:51 IST; 5s ago
       Docs: man:ntpd(8)
    Process: 1090859 ExecStart=/usr/lib/ntp/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
   Main PID: 1090865 (ntpd)
      Tasks: 2 (limit: 38414)
     Memory: 1.4M
        CPU: 52ms
     CGroup: /system.slice/ntp.service
             └─1090865 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 132:139

• If the ntp service is running, analyze the ntpq command output further.
• Stratum number 16 against a remote server may indicate a connectivity issue. Ensure traffic is not blocked by any device like a network firewall.
• Compare the ntpq command output with another working server. Could be possible incorrect NTP server configuration or incorrect ntp servers configured.

Further details to understand ntpq command output can be found on the man page of the command.

For other post related to network security, windows, firewall, visit the blog pages.