1 1 00:00:00,550 --> 00:00:03,520 NTP, the Network Time Protocol. 2 2 00:00:03,520 --> 00:00:06,760 In this lesson, we're going to talk all about NTP, 3 3 00:00:06,760 --> 00:00:08,940 the Network Time Protocol. 4 4 00:00:08,940 --> 00:00:10,720 NTP is a networking protocol 5 5 00:00:10,720 --> 00:00:12,680 that's used for the synchronization of clocks 6 6 00:00:12,680 --> 00:00:14,310 between different computer systems 7 7 00:00:14,310 --> 00:00:16,010 that communicate over a packet-switched, 8 8 00:00:16,010 --> 00:00:18,230 variable-latency data network. 9 9 00:00:18,230 --> 00:00:21,120 Now TCP/IP networks are packet-switched, 10 10 00:00:21,120 --> 00:00:22,960 variable-latency data networks, 11 11 00:00:22,960 --> 00:00:26,000 so NTP is going to be used to synchronize the time 12 12 00:00:26,000 --> 00:00:28,680 across all of our IP-connected servers. 13 13 00:00:28,680 --> 00:00:30,270 Now NTP is pretty special 14 14 00:00:30,270 --> 00:00:32,190 because it's a really old protocol. 15 15 00:00:32,190 --> 00:00:34,400 In fact, it's one of the oldest internet protocols 16 16 00:00:34,400 --> 00:00:36,110 that we still use today. 17 17 00:00:36,110 --> 00:00:40,880 NTP data is going to be sent over UDP using port 123. 18 18 00:00:40,880 --> 00:00:44,430 The most current version of NTP is NTP version 4, 19 19 00:00:44,430 --> 00:00:46,910 and that was released back in 2010. 20 20 00:00:46,910 --> 00:00:50,310 Now NTP is really important in our computer networks 21 21 00:00:50,310 --> 00:00:52,970 because it ensures we're all using the same time. 22 22 00:00:52,970 --> 00:00:55,660 In fact, NTP is designed to synchronize the clocks 23 23 00:00:55,660 --> 00:00:57,480 of all participating computers 24 24 00:00:57,480 --> 00:01:00,690 to within a few milliseconds of the UTC 25 25 00:01:00,690 --> 00:01:03,240 or the Coordinated Universal Time. 26 26 00:01:03,240 --> 00:01:06,800 Now you can have an internal NTP server within your network, 27 27 00:01:06,800 --> 00:01:08,510 which is usually going to be more accurate 28 28 00:01:08,510 --> 00:01:10,270 up to within a few milliseconds, 29 29 00:01:10,270 --> 00:01:13,100 or you can use an external NTP server 30 30 00:01:13,100 --> 00:01:14,950 that is publicly available on the internet, 31 31 00:01:14,950 --> 00:01:16,560 but the accuracy of this 32 32 00:01:16,560 --> 00:01:19,380 is only within tens of milliseconds. 33 33 00:01:19,380 --> 00:01:22,730 Now why is it important to care so much about time? 34 34 00:01:22,730 --> 00:01:25,330 Well, the reason that using NTP is so important 35 35 00:01:25,330 --> 00:01:27,000 and making sure time is accurate 36 36 00:01:27,000 --> 00:01:29,090 is that a lot of our security protocols 37 37 00:01:29,090 --> 00:01:32,450 rely on reliable time for things to work properly. 38 38 00:01:32,450 --> 00:01:33,300 For example, 39 39 00:01:33,300 --> 00:01:35,870 if the time between your workstation and your server 40 40 00:01:35,870 --> 00:01:38,020 are off by more than about five minutes, 41 41 00:01:38,020 --> 00:01:38,870 you could get an error 42 42 00:01:38,870 --> 00:01:41,200 that prevents you from logging in to the domain. 43 43 00:01:41,200 --> 00:01:44,180 So how do we make sure NTP works? 44 44 00:01:44,180 --> 00:01:45,810 Well, to learn how it works, 45 45 00:01:45,810 --> 00:01:47,920 we need to talk about three components: 46 46 00:01:47,920 --> 00:01:50,870 the stratum, the clients, and the servers. 47 47 00:01:50,870 --> 00:01:53,160 Well, NTP is designed to use a hierarchal, 48 48 00:01:53,160 --> 00:01:55,670 semi-layered system of time sources. 49 49 00:01:55,670 --> 00:01:58,810 Each layer of this hierarchy is known as a stratum. 50 50 00:01:58,810 --> 00:02:00,410 As with most things in computers, 51 51 00:02:00,410 --> 00:02:02,830 we begin counting our stratum with zero, 52 52 00:02:02,830 --> 00:02:04,980 and then we start counting up one each time 53 53 00:02:04,980 --> 00:02:06,890 as we go further down the hierarchy. 54 54 00:02:06,890 --> 00:02:09,190 So if we start with Stratum 0, 55 55 00:02:09,190 --> 00:02:11,770 this is the most precise timekeeping devices 56 56 00:02:11,770 --> 00:02:13,120 that we have access to. 57 57 00:02:13,120 --> 00:02:15,770 This includes things like the atomic clock, GPS, 58 58 00:02:15,770 --> 00:02:17,720 and other very accurate devices 59 59 00:02:17,720 --> 00:02:20,050 that generate a pulse per second as a trigger 60 60 00:02:20,050 --> 00:02:22,260 to create an interrupt and create a timestamp 61 61 00:02:22,260 --> 00:02:23,770 on a connected computer. 62 62 00:02:23,770 --> 00:02:26,580 If you're directly connected to a time source like this, 63 63 00:02:26,580 --> 00:02:28,700 you are in Stratum 0. 64 64 00:02:28,700 --> 00:02:31,690 These Stratum 0 clocks are known as reference clocks. 65 65 00:02:31,690 --> 00:02:34,410 It's important to note that the NTP server itself 66 66 00:02:34,410 --> 00:02:36,920 cannot be considered at Stratum 0. 67 67 00:02:36,920 --> 00:02:38,980 Only these reference clocks can. 68 68 00:02:38,980 --> 00:02:42,130 So the first NTP servers we have in our hierarchy 69 69 00:02:42,130 --> 00:02:44,400 will actually occur at Stratum 1, 70 70 00:02:44,400 --> 00:02:46,530 which is any computer whose time source 71 71 00:02:46,530 --> 00:02:49,050 is synchronized to within a few microseconds 72 72 00:02:49,050 --> 00:02:51,380 of an attached Stratum 0 device. 73 73 00:02:51,380 --> 00:02:54,100 To verify their time, these Stratum 1 servers 74 74 00:02:54,100 --> 00:02:56,280 can also pair with other Stratum 1 servers. 75 75 00:02:56,280 --> 00:02:58,210 And that way, they can verify their time 76 76 00:02:58,210 --> 00:02:59,700 is accurate as well. 77 77 00:02:59,700 --> 00:03:03,550 These Stratum 1 servers are known as primary time servers. 78 78 00:03:03,550 --> 00:03:06,840 Next, we have NTP servers at Stratum 2. 79 79 00:03:06,840 --> 00:03:08,560 A Stratum 2 server is connected 80 80 00:03:08,560 --> 00:03:10,790 to a synchronized Stratum 1 server. 81 81 00:03:10,790 --> 00:03:12,470 Often, a Stratum 2 server 82 82 00:03:12,470 --> 00:03:15,240 is configured to query multiple Stratum 1 servers 83 83 00:03:15,240 --> 00:03:17,900 to ensure it has a stable and robust time source 84 84 00:03:17,900 --> 00:03:20,650 to provide the other devices within its peer group. 85 85 00:03:20,650 --> 00:03:23,280 The next level we go to is Stratum 3. 86 86 00:03:23,280 --> 00:03:24,670 These Stratum 3 servers 87 87 00:03:24,670 --> 00:03:27,460 are synchronized upward to Stratum 2 servers. 88 88 00:03:27,460 --> 00:03:28,710 This pattern continues 89 89 00:03:28,710 --> 00:03:31,380 with Stratum 4 synchronizing the Stratum 3, 90 90 00:03:31,380 --> 00:03:34,780 Stratum 5 synchronizing the Stratum 4, and so on. 91 91 00:03:34,780 --> 00:03:37,090 Each time, we add a little bit more delay 92 92 00:03:37,090 --> 00:03:40,130 and things become a little bit further from Stratum 0 93 93 00:03:40,130 --> 00:03:42,620 with that precise time that we started with. 94 94 00:03:42,620 --> 00:03:44,700 Now there is a limit to how many layers 95 95 00:03:44,700 --> 00:03:48,740 or stratum we can have in NTP, and the limit is 15. 96 96 00:03:48,740 --> 00:03:51,780 If something is classified as a Stratum 16 device, 97 97 00:03:51,780 --> 00:03:54,440 this indicates that the device is unsynchronized 98 98 00:03:54,440 --> 00:03:57,100 according to the algorithm and the protocol. 99 99 00:03:57,100 --> 00:04:00,350 So what does this look like in your enterprise networks? 100 100 00:04:00,350 --> 00:04:02,550 Well, usually, you're going to connect the time server 101 101 00:04:02,550 --> 00:04:05,120 to your network, or you're going to run a time service 102 102 00:04:05,120 --> 00:04:06,850 on something like your domain controller 103 103 00:04:06,850 --> 00:04:09,360 with a dedicated hardware reference clock. 104 104 00:04:09,360 --> 00:04:11,080 This will be at one of those stratum levels 105 105 00:04:11,080 --> 00:04:13,180 we already discussed, depending on how far away 106 106 00:04:13,180 --> 00:04:16,080 from the time source you are at Stratum 0. 107 107 00:04:16,080 --> 00:04:17,390 Then you're going to install 108 108 00:04:17,390 --> 00:04:19,610 a piece of client software on each workstation 109 109 00:04:19,610 --> 00:04:22,320 to interface with your server and get the time. 110 110 00:04:22,320 --> 00:04:23,520 If you're using Windows, 111 111 00:04:23,520 --> 00:04:25,440 it already has this functionality built in 112 112 00:04:25,440 --> 00:04:26,440 to its workstations, 113 113 00:04:26,440 --> 00:04:29,440 and your domain controllers can run the NTP service 114 114 00:04:29,440 --> 00:04:32,670 to act as their time source at one of the stratum levels. 115 115 00:04:32,670 --> 00:04:35,680 So you can make sure everybody has the same time 116 116 00:04:35,680 --> 00:04:36,620 within your network, 117 117 00:04:36,620 --> 00:04:39,370 and they don't have problems logging on to your domain. 118 118 00:04:40,394 --> 00:04:42,628 line:15% (futuristic music)