Structure of the NTP Data packet

	0 1 4 7 15 23 31
Cryptosum	LI	VN	Mode	Strat	Poll	Prec	LI = leap indicator VN = version number Strat = Stratum (0-15) Poll = poll intervall Prec = Precision
Root Delay
Root Dispersion
Reference Identifier
Reference Timestamp Seconds (32), Fraction (32)
Originate Timestamp Seconds (32), Fraction (32)
Receive Timestamp Seconds (32), Fraction (32)
Transmit Timestamp Seconds (32), Fraction (32)
Ext. Field 1 Key Identifier (optional)
Ext. Field 2 Message Digest (optional)
Authenticator (Optional)	Key/Algorithm Identifier
Message Hash (64 or 128)

0    1      4         7          15        23                    31

Cryptosum

Mode

Strat

Poll

Prec

LI = leap indicator
VN = version number
Strat = Stratum (0-15)
Poll = poll intervall
Prec = Precision

Root Delay

Root Dispersion

Reference Identifier

Reference Timestamp Seconds (32), Fraction (32)

Originate Timestamp Seconds (32), Fraction (32)

Receive Timestamp Seconds (32), Fraction (32)

Transmit Timestamp Seconds (32), Fraction (32)

Ext. Field 1 Key Identifier (optional)

Ext. Field 2 Message Digest (optional)

Authenticator (Optional)

Key/Algorithm Identifier

Message Hash (64 or 128)


LI	Leap Indicator (2 bits) This field indicates whether the last minute of the current day is to have a leap second applied. The field values follow:
	0: No leap second adjustment
	1: Last minute of the day has 61 seconds
	2: Last minute of the day has 59 seconds
	3: Clock is unsynchronized>
VN	NTP Version Number (3 bits) (current version is 4).
Mode	NTP packet mode (3 bits) The values of the Mode field follow:
	0: Reserved
	1: Symmetric active
	2: Symmetric passive
	3: Client
	4: Server
	5: Broadcast
	6: NTP control message
	7: Reserved for private use
Stratum	Stratum level of the time source (8 bits) The values of the Stratum field follow:
	0: Unspecified or invalid
	1: Primary server
	2–15: Secondary server
	16: Unsynchronized
	17–255: Reserved
Poll	Poll interval (8-bit signed integer)2 value of the maximum interval between successive NTP messages, in seconds.
Precision	Clock precision (8-bit signed integer) The precision of the system clock, in log2 seconds.
Root Delay	The total round-trip delay from the server to the primary reference sourced. The value is a 32-bit signed fixed-point number in units of seconds, with the fraction point between bits 15 and 16. This field is significant only in server messages.
Root Dispersion	The maximum error due to clock frequency tolerance. The value is a 32-bit signed fixed-point number in units of seconds, with the fraction point between bits 15 and 16. This field is significant only in server messages.
Reference Identifier	For stratum 1 servers this value is a four-character ASCII code that describes the external reference source (refer to Figure 2). For secondary servers this value is the 32-bit IPv4 address of the synchronization source, or the first 32 bits of the Message Digest Algorithm 5 (MD5) hash of the IPv6 address of the synchronization source.

Leap Indicator (2 bits)
This field indicates whether the last minute of the current day is to
have a leap second applied. The field values follow:

0: No leap second adjustment

1: Last minute of the day has 61 seconds

2: Last minute of the day has 59 seconds

3: Clock is unsynchronized>

NTP Version Number (3 bits) (current version is 4).

Mode

NTP packet mode (3 bits) The values of the Mode field follow:

0: Reserved

1: Symmetric active

2: Symmetric passive

3: Client

4: Server

5: Broadcast

6: NTP control message

7: Reserved for private use

Stratum

Stratum level of the time source (8 bits) The values of the
Stratum field follow:

0: Unspecified or invalid

1: Primary server

2–15: Secondary server

16: Unsynchronized

17–255: Reserved

Poll

Poll interval (8-bit signed integer)2 value of the
maximum interval between successive NTP messages, in seconds.

Precision

Clock precision (8-bit signed integer) The precision of the
system clock, in log2 seconds.

Root Delay

The total round-trip delay from the server to the primary
reference sourced. The value is a 32-bit signed fixed-point
number in units of seconds, with the fraction point between
bits 15 and 16. This field is significant only in server messages.

Root Dispersion

The maximum error due to clock frequency tolerance. The
value is a 32-bit signed fixed-point number in units of
seconds, with the fraction point between bits 15 and 16.
This field is significant only in server messages.

Reference Identifier

For stratum 1 servers this value is a four-character
ASCII code that describes the external reference source
(refer to Figure 2). For secondary servers this value
is the 32-bit IPv4 address of the synchronization source,
or the first 32 bits of the Message Digest Algorithm 5
(MD5) hash of the IPv6 address of the synchronization source.

Code	External Reference Source
-------------------------------------------------------
LOCL	uncalibrated local clock
CESM	Calibrated Cesium clock
RBDM	calibrated Rubidium clock
PPS	calibrated quartz clock or other pulse-per-second source
IRIG	Inter-Range Instrumentation Group
ACTS	NIST telephone modem service
USNO	USNO telephone modem service<
PTB	PTB (Germany) telephone modem service
TDF	Allouis (France) Radio 164 kHz
DCF	Mainflingen (Germany) Radio 77.5 kHz
MSF	Rugby (UK) Radio 60 kHz
WWV	Ft. Collins (US) Radio 2.5, 5, 10, 15, 20 MHz
WWVB	Boulder (US) Radio 60 kHz
WWVH	Kauai Hawaii (US) Radio 2.5, 5, 10, 15 MHz
CHU	Ottawa (Canada) Radio 3330, 7335, 14670 kHz
LORC	LORAN-C radionavigation system
OMEG	OMEGA radionavigation system
GPS	Global Positioning Service

Code

External Reference Source

-------------------------------------------------------

LOCL

uncalibrated local clock

CESM

Calibrated Cesium clock

RBDM

calibrated Rubidium clock

PPS

calibrated quartz clock or other pulse-per-second source

IRIG

Inter-Range Instrumentation Group

ACTS

NIST telephone modem service

USNO

USNO telephone modem service<

PTB

PTB (Germany) telephone modem service

TDF

Allouis (France) Radio 164 kHz

DCF

Mainflingen (Germany) Radio 77.5 kHz

MSF

Rugby (UK) Radio 60 kHz

WWV

Ft. Collins (US) Radio 2.5, 5, 10, 15, 20 MHz

WWVB

Boulder (US) Radio 60 kHz

WWVH

Kauai Hawaii (US) Radio 2.5, 5, 10, 15 MHz

CHU

Ottawa (Canada) Radio 3330, 7335, 14670 kHz

LORC

LORAN-C radionavigation system

OMEG

OMEGA radionavigation system

GPS

Global Positioning Service

Cient	Connection	Server
Timestamp 1		Timestamp 2
Timestamp 4		Timestamp 3

Cient

Connection

Server

Timestamp 1

Timestamp 2

Timestamp 4

Timestamp 3

From these four timestamps the system can calculate two values:

The "Delay" , the time that was needed to transfer the packet in the network, and
the "Offset" , time difference of two computer clocks.

Here you can see that NTP averages the Delay because it assumes that the trip of the packet is the same in both directions, that means differences influence the Offset as an error. In local networks the round-trip delay is only a small part of the offset and therefor the offset calculation is already precise. In bigger networks the offsets and delays are filtered more often, to compensate the delay variations. The offset is calculated from the packet with the smallest delay out of the last eight packets. Additionally an other value is calculated from the same packets:
The " Dispersion " value, an averaged value of the offset deviation from the eight last data packets to the actual offset. The offsets with a smaller delay are weighted more.

Offset =	(t2 - t1) + (t3 - t4) ----------------- 2
Delay =	(t4 - t1) - (t3 - t2)

NTP timestamp format (64 bits) :
Seconds (32)	Fraction (32)
Seconds and Fractions since 01.01.1900