Question 1

What is UDP port 123 and why is it critical for NTP?

Accepted Answer

UDP 123 is the well-known port for the NTP protocol. Both client->server requests and server responses use it; NTP is stateless at the protocol level so firewalls must allow bidirectional traffic on 123/udp between clients and configured sources. A unidirectional rule that allows outbound but not return traffic silently breaks synchronisation. Our firewall guide covers iptables, firewalld, ufw and Windows Firewall in detail.

Question 2

What does 'stratum 16' mean and how do I fix it?

Accepted Answer

Stratum 16 means the NTP daemon has no valid time source — it is either unable to reach any configured server, or all candidates failed the sanity checks. Common causes: UDP 123 blocked, all servers stuck in .INIT, clock offset too large for panic-reject threshold, or insufficient samples. Fix by verifying connectivity ('chronyc sources' should show >=1 reachable source), checking panic threshold (default 1000 s), and forcing a step with 'chronyc makestep' or 'ntpd -gq'.

Question 3

What does 'reach 0' or 'reach 377' mean in ntpq?

Accepted Answer

The reach column is an 8-bit rolling shift register tracking the last 8 polls per peer. Each successful response shifts in a 1, each miss shifts in a 0. Reach 377 octal (11111111 binary) means all 8 last polls succeeded — ideal. Reach 0 means the last 8 polls all failed — the peer is unreachable. Intermediate values like 17 (00001111) show partial reachability. Our reach-0 guide walks through the diagnostic.

Question 4

What is an NTP false ticker?

Accepted Answer

A false ticker is a configured NTP source whose reported time disagrees significantly with the majority of other sources. NTP's selection algorithm marks it with 'x' in ntpq or rejects it in chrony, and it is excluded from the clock combine step. Usually caused by: misconfigured server, clock hardware issue on the remote, or an attacker serving manipulated time. Our false-ticker page explains the detection threshold and how to replace or remove the offending source.

Question 5

chronyd vs ntpd vs systemd-timesyncd — which should I run?

Accepted Answer

chronyd (default on RHEL 8+, Ubuntu 22.04+): best for laptops, intermittent connections, virtualisation. Supports NTS out of the box. ntpd / ntpsec: still maintained; preferred if you need refclock drivers (GPS, PPS) or symmetric-key auth at scale. systemd-timesyncd: minimal SNTP client, client-only, OK for desktops but cannot serve time or handle NTS. For servers in 2026: chronyd 4.x unless you have a refclock requirement.

NTP Diagnostic & Troubleshooting

Live Diagnostic Results

Common NTP Problems Detected

Troubleshooting Checklist

Firewall Port 123 (UDP)

NTP Daemon Status

Stratum Level Issues

False Ticker Detection

Quick Fix: w32tm & Chrony Commands

Windows (w32tm)

Linux (Chrony)

Free NTP Synchronization Guide

Tired of Clock Skew Issues?