Implement NTP: Query a Time Server and Parse the Response

Topic Overview

The 48-Byte NTP Packet

NTP synchronizes clocks over UDP port 123. The packet is exactly 48 bytes. Byte 0 packs leap indicator (2 bits), version 4 (3 bits), and mode (3 bits). For example, a client request sets mode 3; the server reply sets mode 4.

Key Fields

• Byte 1: stratum (1-15 for valid servers, 16 = unsynchronized)
• Bytes 4-7: root delay (32-bit fixed-point seconds)
• Bytes 12-15: reference ID (4 ASCII chars or IPv4 like 129.6.15.28)
• Bytes 16-47: four 64-bit timestamps (reference, origin, receive, transmit)

Timestamp Conversion

NTP timestamps count seconds since 1900-01-01 with a 32-bit fraction for sub-second precision. Convert to Unix time by subtracting 2208988800 (the 1900-to-1970 offset). The fractional part gives roughly 233 picoseconds per unit. Clients compute clock offset by comparing transmit and receive timestamps, accounting for network delay. Pool servers like pool.ntp.org and stratum-1 sources such as 129.6.15.28 answer thousands of these 48-byte queries per second.

Why This Exercise

This task requires you to build an NTP client query and parse the response timestamps. chrony and ntpd on every Linux machine parse this exact format defined in RFC 5905 to keep clocks synchronized across the internet. The 2014 NTP amplification DDoS wave exploited deprecated commands on this same protocol, turning small spoofed queries to port 123 into massive reflected floods.

Write a C program that implements the NTP on-wire arithmetic from RFC 5905: given the four exchange timestamps of a client/server poll, compute the clock offset and round-trip delay, and convert the server's timestamp to Unix time.

Input: four decimal integers on one line, T1 T2 T3 T4, all in NTP seconds (seconds since 1900-01-01):

• T1: origin timestamp: when the client sent the request
• T2: receive timestamp: when the server received it
• T3: transmit timestamp: when the server sent the reply
• T4: destination timestamp: when the client received the reply

Output:

• Line 1: offset=N: clock offset of the server relative to the client: offset = ((T2 - T1) + (T3 - T4)) / 2, truncated toward negative infinity
• Line 2: delay=N: round-trip delay: delay = (T4 - T1) - (T3 - T2), truncated toward negative infinity
• Line 3: server_time=N. T3 converted to Unix seconds (since 1970-01-01) by subtracting the 2208988800-second NTP/Unix epoch offset

Example: 1000000000 1000000002 1000000001 1000000001 gives offset=1, delay=2. A positive offset means the server clock is ahead of the client; a negative offset means it is behind. No sockets needed: the timestamps arrive on stdin.