Implement NTP: Query a Time Server and Parse the Response

The 48-Byte NTP Packet

NTP synchronizes clocks over UDP port 123. The packet is exactly 48 bytes. Byte 0 packs leap indicator (2 bits), version 4 (3 bits), and mode (3 bits). For example, a client request sets mode 3; the server reply sets mode 4.

Key Fields

• Byte 1: stratum (1-15 for valid servers, 16 = unsynchronized)
• Bytes 4-7: root delay (32-bit fixed-point seconds)
• Bytes 12-15: reference ID (4 ASCII chars or IPv4 like 129.6.15.28)
• Bytes 16-47: four 64-bit timestamps (reference, origin, receive, transmit)

Timestamp Conversion

NTP timestamps count seconds since 1900-01-01 with a 32-bit fraction for sub-second precision. Convert to Unix time by subtracting 2208988800 (the 1900-to-1970 offset). The fractional part gives roughly 233 picoseconds per unit. Clients compute clock offset by comparing transmit and receive timestamps, accounting for network delay. Pool servers like pool.ntp.org and stratum-1 sources such as 129.6.15.28 answer thousands of these 48-byte queries per second.

Why This Exercise

This task requires you to build an NTP client query and parse the response timestamps. chrony and ntpd on every Linux machine parse this exact format defined in RFC 5905 to keep clocks synchronized across the internet. The 2014 NTP amplification DDoS wave exploited deprecated commands on this same protocol, turning small spoofed queries to port 123 into massive reflected floods.