[ntp:questions] Clarification on the org, rec, xmt header fields

Noah Campbell noahcampbell at gmail.com
Sat May 16 17:24:32 UTC 2009

On May 16, 12:10 am, hal-use... at ip-64-139-1-69.sjc.megapath.net (Hal
Murray) wrote:
> >...and I'm curious about the timestamps.  I don't quite understand the
> >values presented.  I've been pouring through the NTPv4 specification,
> >but it doesn't provide a great deal of explanation.
> If you assume a client-server model, from the client's view
> there are 4 time stamps:
>   when the request leaves the client
>   when the request arrives at the server
>   when the response leaves the server
>   when the response arrives at the client

This model makes complete sense.  What I'm curious about is that I
would imagine that mode = 3, the only timestamp that is struck is the
'request leaves' (org) but what I see is request arrives (rec) and the
response leaves (xmt) in the client packet.  What else is odd is that
the (org) is 10 milliseconds after the (rec) and the (xmt) is 8
minutes in the future!

My guess is that this has to do with the peer system process, but I'm
not finding an adequate description to bring me up to speed.

> If you assume tha the network delays are symmetric,
> you can figure out the network delay and clock offset
> from those 4 numbers.
> The key idea is that the server can twiddle it's thumbs
> and do lots of crypto stuff and/or whatever else it
> wants between the time the request arrives and the
> time it sends the response.  That's why you need 4 time
> stamps rather than only 3.
> --
> These are my opinions, not necessarily my employer's.  I hate spam.

More information about the questions mailing list