Skip to Content

check NTP server in Ubuntu

By: Author Archit Modi

Posted on Last updated:

0 Comments

Categories network

In this blog post, we will show you how to check the NTP server on Ubuntu. The NTP service is used to synchronize the time on your computer with a time server. This can help ensure that your system is always running accurately and on schedule. Let’s take a look at how to check the NTP server on Linux!

What is NTP?

The Network Time Protocol (NTP) is a protocol used to synchronize the time on your computer with a time server. This can help ensure that your system is always running accurately and on schedule. By default, most Linux distributions come with the Network Time Protocol (NTP) service installed and running.

In Ubuntu, you can use the following command to check the time sync service.

# systemctl status systemd-timesyncd.service 
● systemd-timesyncd.service - Network Time Synchronization
     Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2022-05-09 01:56:22 UTC; 10 months 1 days ago
       Docs: man:systemd-timesyncd.service(8)
   Main PID: 341 (systemd-timesyn)
     Status: "Initial synchronization to time server 169.254.169.123:123 (169.254.169.123)."
      Tasks: 2 (limit: 4691)
     Memory: 1.3M
     CGroup: /system.slice/systemd-timesyncd.service
             └─341 /lib/systemd/systemd-timesyncd

# timedatectl status
               Local time: Fri 2023-03-10 14:30:14 UTC
           Universal time: Fri 2023-03-10 14:30:14 UTC
                 RTC time: Fri 2023-03-10 14:30:14    
                Time zone: Etc/UTC (UTC, +0000)       
System clock synchronized: yes                        
              NTP service: active                     
          RTC in local TZ: no

Check NTP server from configuration file in Ubuntu

If you want to see the list of NTP servers that your system is currently configured to use, type the following command:

cat /etc/systemd/timesyncd.conf

This will display the configuration file for the systemd-timesyncd service, which manages time synchronization on Ubuntu.

Look for the line that reads “NTP=”. This should contain the list of NTP servers that your system is currently configured to use.

cat /etc/systemd/timesyncd.conf 
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See timesyncd.conf(5) for details.

[Time]
NTP=169.254.169.123
#FallbackNTP=ntp.ubuntu.com
#RootDistanceMaxSec=5
PollIntervalMinSec=16
PollIntervalMaxSec=17

We can see that our NTP server is 169.254.169.123.

Check NTP server using tcpdump command in Ubuntu

The default port used by NTP (Network Time Protocol) is port 123. This port is used to synchronize the time on networked devices by exchanging time-stamped packets between servers and clients.

NTP clients initiate communication with NTP servers on port 123, and the servers respond on the same port.

So we can get the NTP server by capturing network packets on port 123.

Run the tcpdump command to capture NTP traffic on your system. You can do this by running the following command:

sudo tcpdump -vvvn -i any port 123

This command captures NTP traffic on port 123 and displays it in verbose mode. Wait for a few minutes for the NTP traffic to appear. Press Ctrl+C to stop tcpdump from capturing packets.

Here is one example:

tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
14:19:41.486944 IP (tos 0x10, ttl 64, id 12336, offset 0, flags [DF], proto UDP (17), length 76)
    10.0.0.76.50675 > 169.254.169.123.123: [bad udp cksum 0x5e0f -> 0x6813!] NTPv4, length 48
	Client, Leap indicator:  (0), Stratum 0 (unspecified), poll 0 (1s), precision 0
	Root Delay: 0.000000, Root dispersion: 0.000000, Reference-ID: (unspec)
	  Reference Timestamp:  0.000000000
	  Originator Timestamp: 0.000000000
	  Receive Timestamp:    0.000000000
	  Transmit Timestamp:   3887446781.113366156 (2023/03/10 14:19:41)
	    Originator - Receive Timestamp:  0.000000000
	    Originator - Transmit Timestamp: 3887446781.113366156 (2023/03/10 14:19:41)
14:19:41.487332 IP (tos 0x0, ttl 255, id 34569, offset 0, flags [DF], proto UDP (17), length 76)
    169.254.169.123.123 > 10.0.0.76.50675: [udp sum ok] NTPv4, length 48
	Server, Leap indicator:  (0), Stratum 3 (secondary reference), poll 0 (1s), precision -24
	Root Delay: 0.000305, Root dispersion: 0.000244, Reference-ID: 22.130.22.71
	  Reference Timestamp:  3887446779.888526010 (2023/03/10 14:19:39)
	  Originator Timestamp: 3887446781.113366156 (2023/03/10 14:19:41)
	  Receive Timestamp:    3887446781.487116342 (2023/03/10 14:19:41)
	  Transmit Timestamp:   3887446781.487231209 (2023/03/10 14:19:41)
	    Originator - Receive Timestamp:  +0.373750186
	    Originator - Transmit Timestamp: +0.373865053

We can get the NTP server from the command output. We can also analyze the output of tcpdump to determine whether your NTP server is working properly. If you see a lot of packets being sent and received on port 123, it means that your NTP server is working fine. If you don’t see any packets, or if you see errors, it means that there may be a problem with your NTP server.