EN FR

NTP Diagnostic & Troubleshooting

Port 123 · Stratum 16 · Reach 0 · False Ticker — live scan and sysadmin playbook

Firewall & Port 123 → Stratum 16 Fix → Reach 0 → False Ticker →

Live Diagnostic Results

[root@system ~]#
Initiating NTP diagnostic scan...
Connecting to reference server...
Time Offset
--
Network Latency
--
Sync Status
TESTING
✓ System Check Running
Get your NTP checklist (2 min) →

A few questions, one click per answer: each answer shows a tip, the checklist comes at the end. No sign-up.

Common NTP Problems Detected

Running diagnostics...

Troubleshooting Checklist

Firewall Port 123 (UDP)

Ensure UDP port 123 is open for NTP communication. Check: sudo ufw allow 123/udp
Complete firewall configuration guide for iptables, firewalld, ufw & Windows →

NTP Daemon Status

Verify your NTP service is running. Check: systemctl status chronyd or systemctl status ntpd
Fix ntpd, chronyd & systemd-timesyncd issues step by step →

Stratum Level Issues

If showing Stratum 16, your NTP daemon has no valid time source. Check server configuration and network connectivity.
Troubleshoot Stratum 16 & no sync source →

False Ticker Detection

Server marked as "false ticker" means time disagreement with other sources. Review /etc/ntp.conf or /etc/chrony/chrony.conf
Understand and fix false ticker issues →

Quick Fix: w32tm & Chrony Commands

Windows (w32tm)

C:\> w32tm /config /manualpeerlist:"ntp-pool.rdem-systems.com" /syncfromflags:manual /update C:\> net stop w32time && net start w32time C:\> w32tm /resync /force Sending resync command to local computer... The command completed successfully.

Linux (Chrony)

root@server:~# chronyc sources -v root@server:~# chronyc makestep 200 OK 200 OK root@server:~# chronyc tracking

Complete w32tm & Chrony Guide →

Free NTP Synchronization Guide

Get our comprehensive whitepaper: "Time Synchronization Best Practices for Windows & Linux"

  • ✓ Complete w32tm configuration for Active Directory
  • ✓ Chrony vs ntpd: which to choose
  • ✓ Firewall rules and network architecture
  • ✓ Troubleshooting Stratum 16 and false tickers

No spam. Unsubscribe anytime. We respect your privacy.

Tired of Clock Skew Issues?

Stop fighting with unreliable public pools. Secure your mission-critical logs and Active Directory with a dedicated NTP source.

Enterprise-Grade NTP Solutions →

Enterprise-grade SLAs and infrastructure monitoring

Discover also — RDEM Systems operates managed Proxmox backup infrastructure for enterprise environments. Explore our PBS backup plans for reliable off-site data protection.

Fixed the diagnostic? Move to the next step:

About check-ntp.net — A free real-time NTP diagnostic service. Queries run directly from the RDEM Systems network and are compared against GNSS/PPS Stratum 1 references. We actively contribute to the NTP Pool project and publish our own servers: 16 Stratum 2 servers with NTS, plus a GNSS/PPS Stratum 1.
About the author

Frequently asked questions

What is UDP port 123 and why is it critical for NTP?

UDP 123 is the well-known port for the NTP protocol. Both client->server requests and server responses use it; NTP is stateless at the protocol level so firewalls must allow bidirectional traffic on 123/udp between clients and configured sources. A unidirectional rule that allows outbound but not return traffic silently breaks synchronisation. Our firewall guide covers iptables, firewalld, ufw and Windows Firewall in detail.

What does 'stratum 16' mean and how do I fix it?

Stratum 16 means the NTP daemon has no valid time source — it is either unable to reach any configured server, or all candidates failed the sanity checks. Common causes: UDP 123 blocked, all servers stuck in .INIT, clock offset too large for panic-reject threshold, or insufficient samples. Fix by verifying connectivity ('chronyc sources' should show >=1 reachable source), checking panic threshold (default 1000 s), and forcing a step with 'chronyc makestep' or 'ntpd -gq'.

What does 'reach 0' or 'reach 377' mean in ntpq?

The reach column is an 8-bit rolling shift register tracking the last 8 polls per peer. Each successful response shifts in a 1, each miss shifts in a 0. Reach 377 octal (11111111 binary) means all 8 last polls succeeded — ideal. Reach 0 means the last 8 polls all failed — the peer is unreachable. Intermediate values like 17 (00001111) show partial reachability. Our reach-0 guide walks through the diagnostic.

What is an NTP false ticker?

A false ticker is a configured NTP source whose reported time disagrees significantly with the majority of other sources. NTP's selection algorithm marks it with 'x' in ntpq or rejects it in chrony, and it is excluded from the clock combine step. Usually caused by: misconfigured server, clock hardware issue on the remote, or an attacker serving manipulated time. Our false-ticker page explains the detection threshold and how to replace or remove the offending source.

chronyd vs ntpd vs systemd-timesyncd — which should I run?

chronyd (default on RHEL 8+, Ubuntu 22.04+): best for laptops, intermittent connections, virtualisation. Supports NTS out of the box. ntpd / ntpsec: still maintained; preferred if you need refclock drivers (GPS, PPS) or symmetric-key auth at scale. systemd-timesyncd: minimal SNTP client, client-only, OK for desktops but cannot serve time or handle NTS. For servers in 2026: chronyd 4.x unless you have a refclock requirement.