The significant NTP events are as follows:
Expiry of a peer timer
Only a host operating in the active mode can encounter this situation. This event also occurs when the NTP messages sent by various peers reach their destination.
Operator command or system fault, such as a primary reference source failure
In all modes (except the client mode with a broadcast server and the server mode), the transmit process starts when the peer timer expires. In the client mode with a broadcast server, messages are never sent. In the server mode, messages are sent only in response to received messages. This process is also invoked by the receive process when the received NTP message does not result in a local persistent association. To ensure a valid response, the transmit timestamp must be added to packets to be sent. Therefore, the values of variables carried in the response packet must be accurately saved.
Broadcast and multicast servers that are not synchronized will start the transmit process when the peer timer expires.
The receive process starts when an NTP message arrives. First, it checks the mode field in the packet. Value 0 indicates that the peer runs an earlier NTP version. If the version number in the packet matches the current version, the receive process continues with the following steps. If the version numbers do not match, the packet is discarded, and the association (if not pre-configured) is dissolved. The receive process various according to the following result of calculating the combination of the local and remote clock modes:
If both the local and remote hosts are operating in client mode, an error occurs, and the packet is discarded.
If the result is recv, the packet is processed, and the association is marked reachable if the received packet contains a valid header. In addition, if the received packet contains valid data, the clock-update process is called to update the local clock. If the association was not previously configured, it is dissolved.
If the result is xmit, the packet is processed, and an immediate response packet is sent. The association is then dissolved if it is not pre-configured.
If the result is pkt, the packet is processed, and the association is marked reachable if the received packet contains a valid header. In addition, if the received packet contains valid data, the clock-update process is called to update the local clock. If the association was not pre-configured, an immediate reply is sent, and the association is dissolved.
The packet process checks message validity, calculates delay/offset samples, and invokes other processes to filter data and select a reference source. First, the transmit timestamp must be different from the transmit timestamp in the last message. If the transmit timestamp are the same, the message may be an outdated duplicate message.
Second, the originate timestamp must match the last message sent to the same peer. If a mismatch occurs, the message may be out of order, forged, or defective.
Lastly, the packet process uses a clock selection algorithm to select the best clock sample from the specified clocks or clock groups at different stratums. The delay (peer delay), offset (peer offset), and dispersion (peer dispersion) for the peer are all determined.
After the offset, delay, and dispersion of the valid clock are determined by the clock-filter process, the clock-selection process invokes the clock-update process. The result of the clock-selection and clock-combining processes is the final clock correction value. The local-clock updates the local clock with this value. If no reference source is found after these processes, the clock-update process does not perform any other operation.
The intersection algorithm generates a list of candidate peers suitable to be the reference source and calculates a confidence interval for each peer. It discards falsetickers using a technique adopted from Marzullo and Owicki [MAR85].
The clustering algorithm orders the list of remaining candidates based on their stratums and synchronization distances. It repeatedly discards outlier peers based on the dispersion until only the most accurate, precise, and stable candidates remain.
If the offset, delay, and dispersion of the candidate peers are almost identical, first analyze the clock situation by combining candidates. Then provide the parameters determined through comprehensive analysis to the local end for updating the local clock.