NTP: How David Mills Made Distributed Computers Agree on Time

Computers do not naturally agree on time. Their oscillators drift, operating systems pause, packets wait in queues, and a distant reference cannot reveal one-way delay directly. Yet distributed logs, authentication, file timestamps, routing, measurement, and scientific work all need clocks that remain close enough to a common timescale.

David L. Mills spent decades turning that problem into deployable Internet machinery. His early network time experiments led to the Network Time Protocol, first published publicly as RFC 958 in September 1985. Successive versions refined selection, filtering, and clock discipline while preserving a decentralized hierarchy that could operate across the growing Internet.

Early networks exposed the clock problem

Hosts could ask a daytime service for a timestamp, but copying a remote value ignored the network delay between server and client. A packet might take different times in each direction, and setting the clock abruptly could make time move backward for applications.

Mills’s first-person history traces the work to experiments around the late 1970s and an Internet Engineering Note in 1981. The objective became continuous synchronization: exchange timestamped packets, estimate the relationship between clocks and path delay, reject bad observations, and steer a local clock gradually.

That framing changed time from a string fetched occasionally into a control problem running over an unreliable packet network.

Four timestamps separate offset from round-trip delay

In the basic NTP exchange, the client records when it sends a request and when the reply arrives. The server includes its receive and transmit times. With four timestamps, each side can estimate round-trip delay and the offset between the two clocks under an assumption about path symmetry.

The equations cannot reveal the true independent forward and reverse delays from one exchange. If one direction is persistently slower, the offset estimate contains error. Repeated samples and multiple peers provide evidence for selecting lower-delay and more consistent observations.

This is why one ICMP round-trip measurement cannot “correct” NTP and why a server’s geographic proximity is helpful but not a complete quality measure.

RFC 958 established a public protocol

RFC 958 described NTP in 1985 as both a protocol and algorithms for maintaining synchronization. It defined timestamp exchanges, delay and offset calculations, reference information, and a hierarchy of servers tied ultimately to accurate clocks.

The document came before the modern scale and threat environment of the Internet. Later versions revised packet format and algorithms as deployments exposed new cases. NTP version 1 was documented in RFC 1059, version 3 in RFC 1305, and the current NTPv4 specification in RFC 5905.

The sequence shows engineering continuity rather than one perfect design appearing at once. Operational experience fed the next protocol and implementation.

Strata describe distance from a reference

A primary server synchronized directly to a reference clock is stratum 1. A server synchronized to it becomes stratum 2, and the number increases along the synchronization path. Stratum is a topological distance indicator, not a universal ranking of accuracy.

A stable stratum 2 server with several good sources and a clean network path can be a better client choice than a congested stratum 1 server. NTP evaluates peer quality and consistency, not just the smallest number advertised.

The hierarchy spreads load. Ordinary clients do not all query a national time laboratory directly. Organizations can operate local servers that synchronize upstream and serve many nearby systems.

Filtering turns noisy packets into clock evidence

Network delay varies from sample to sample. NTP retains observations, favors those with lower delay under its filter model, and compares candidate sources. Selection and clustering algorithms work to discard falsetickers whose time is inconsistent with the surviving majority.

Redundancy is essential. With only one source, a client can measure its behavior but cannot know whether the remote clock or its own clock is wrong. Multiple independent sources make outliers visible, though shared upstream references and shared network paths can reduce apparent independence.

Operators should choose diverse, authorized sources and monitor reachability, offset, jitter, delay, and selected peer. A green daemon process is not evidence that the system clock has a trustworthy consensus.

Clock discipline avoids repeated hard steps

Once NTP estimates offset and frequency error, a clock-discipline loop adjusts the local clock. Small errors can be corrected by changing its effective rate, preserving monotonic behavior for applications. Large startup errors may require a step according to implementation policy.

Oscillator drift has patterns. Temperature, hardware quality, virtualization pauses, power states, and host scheduling affect it. Learning frequency correction allows a system to hold time more accurately between successful network updates.

An operator who runs a second time-setting tool periodically can fight that control loop. One service speeds the clock while another steps it back, producing unstable timestamps and misleading diagnostics.

Eras and fixed-width timestamps required foresight

The classic NTP timestamp has a fixed-width seconds field plus a fractional field. A finite counter wraps, so the protocol’s interpretation depends on an era and contextual date knowledge. RFC 5905 and related NTP documents explain era handling beyond the first 2036 rollover.

Applications should use maintained libraries and operating-system time services instead of decoding raw timestamps with an unsigned-seconds shortcut. A packet format’s rollover does not mean synchronized time itself must stop, but naïve software can still fail.

Time representation also differs from leap-second policy and local civil-time display. NTP distributes a timescale and leap indicators; timezone rules belong to another database and layer.

The reference implementation was a research vehicle

Mills implemented and measured algorithms as the Internet changed. The daemon and its descendants exposed peer variables, filters, discipline state, and reference identifiers that let operators diagnose behavior rather than accept a single displayed time.

The work linked control theory, distributed systems, operating-system clocks, and network operations. It also created institutions and operational practices around public server pools and organizational time hierarchies.

Later implementations and alternatives changed codebases and security approaches, but they inherited the problem decomposition NTP made practical.

Security became part of time correctness

An unauthenticated time response can be forged or delayed. Older symmetric-key mechanisms and operational filtering offered some protection, while Network Time Security later added a modern authentication and key-establishment design alongside NTP.

Authentication proves a server relationship and packet integrity according to its mechanism. It cannot make a congested or intentionally delayed path symmetric. Time security therefore combines authenticated sources, multiple paths, conservative correction limits, access controls, and monitoring.

A server should not answer unrestricted amplification traffic merely because time is public. Rate limiting and current implementation guidance are part of responsible operation.

NTP made agreement an ongoing process

The protocol never promised one packet could reveal perfect time. It built a system that samples several imperfect paths, rejects inconsistent clocks, estimates local drift, and continually disciplines the result. That is why the architecture scaled from experimental networks to a global Internet.

Mills’s contribution was both the wire exchange and the reasoning around it: hierarchy without one central server, redundancy without trusting every peer, and clock control rather than repeated blind setting. Modern systems still agree on time by treating it as a measured, fallible, continuously corrected distributed state.

Related:

Sources: