NTP glossary

A number of terms describe important entities or activities that are part of NTP. These are defined here.

client mode

The mode in which a host polls a time server that it might synchronize with, but it will not respond to polls from that time server. When a host is operating in this mode, the time server it is polling is said to operate in ``server mode''.

Coordinated Universal Time

The international standard reference time. It also corresponds to the local time at zero longitude. The standards pertaining to the definition and maintenance of Coordinated Universal Time, which effectively replaced Greenwich Mean Time (GMT) on 1 January 1972, are promulgated in Recommendation 460 of the International Consultative Committee for Radio (Comite Consultatif International de Radiodiffusion or CCIR) of the International Telecommunications Union. The CCIR is located at 2, rue de Varembe, 1211 Geneva 20, Switzerland. Responsibility for time standards in the United States rests with the Time and Frequency Division of the National Institute of Standards and Technology (NIST) in Boulder, Colorado.

dispersion

A measure, in seconds, of how scattered the time offsets have been from a given time server.

drift

A measure, in hertz per second, of how quickly the skew of a clock is changing. See also ``skew''.

host

Any computer connected to the network.

Internet

The collection of interconnected networks that grew out of ARPANET, the Defense Advanced Research Projects Agency network, and that use TCP/IP to communicate to function as a single cooperative network.

poll

The sending of an NTP packet from a host to an NTP time server to request the current time. The server responds by recording the current time in the packet, then sending it back to the originating host. See also ``NTP packet''.

NTP packet

A message sent over the network that conforms to the Network Time Protocol format. This format includes space for recording the current time. See also ``poll''.

primary server

Another name for a stratum 1 server. See also ``stratum''.

roundtrip delay

The time it takes for a host to send an NTP packet to another host and get an NTP packet back from that host in reply.

secondary server

Another name for a stratum 2 server.

server mode

The mode in which a time server allows itself to be polled by a host (the client) that wishes to synchronize with it. In this mode, if the time server polls the client to try to synchronize with it, the client does not respond. In this case, the client is said to operate in ``client mode''.

skew

A measure, in hertz, of the difference between the actual frequency of a clock and what its frequency should be to keep perfect time. See also ``drift''.

slew

To adjust gradually the time of a clock until it tells the correct time. Compare with ``step''.

step

To change the time of a clock to the correct time with no intermediate adjustments. Compare with ``slew''.

stratum

The distance a host running the xntpd time daemon is from an external source of Coordinated Universal Time (UTC). A stratum 1 server has direct access to an external source of UTC, such as a radio clock synchronized to a standard time signal broadcast. In general, a stratum n server is n-1 network hops away from a stratum 1 server. For example, a stratum 4 server is 3 hops away from a stratum 1 server. Also, a stratum n server is at a higher stratum than a stratum n-1 server. For example, a stratum 3 server is at a higher stratum than a stratum 2 server, and at a lower stratum than a stratum 4 server. See also ``time daemon''.

symmetric active mode

The mode in which a host has configured itself to poll a time server that it might synchronize with. In this mode, the host also allows itself to be polled by that time server.

symmetric passive mode

The mode in which a time server is polled by a host that has configured itself in ``symmetric active mode''. In this mode, the time server can also poll that host.

synchronization subnet

A collection of hosts that synchronize time with each other. The top layer of the subnet consists of stratum 1 servers.

synchronize clocks

To set two clocks to the same time and ensure that they are running at the same ``speed''. The speed at which a clock runs is determined by its frequency, that is, how often it ``ticks'' to the next fraction of a second. The design of a particular clock determines how small that fraction is.

synchronize with a host

To synchronize the local clock with another host's clock, either by stepping or slewing the local clock to the time reported in the NTP packet received from the most recent poll of that host.

time client

A host running the xntpd time daemon that requests a time server to furnish it with that server's best estimate of Coordinated Universal Time. Hosts running at a stratum higher than 1, except for those at the highest stratum, typically function as both time clients (polling same-stratum or lower-stratum servers) and time servers (furnishing the current time to other hosts). Compare with ``time server''.

time daemon

The program running on a host that synchronizes the host's hardware clock to Coordinated Universal Time in accordance with the protocols known as the Network Time Protocol. The name of this program is xntpd.

time server

A host running the xntpd time daemon that, upon request, furnishes its best estimate of Coordinated Universal Time. Compare with ``time client''.

trap receiver

A program that listens for NTP mode 6 packets sent from another host. The host that ``springs the trap'' by sending the mode 6 packet to the trap receiver does so in response to the occurrence of an exception. These exceptions include the following events:

The host reboots.
The host detects that its clock has been reset.
The host detects that the stratum of some other host in the synchronization subnet has changed.
The host detects that a new host has been added to the synchronization subnet.
The host detects that some other host in the synchronization subnet has become unreachable.
The host detects that some other host in the synchronization subnet has been authenticated.
The host selects another host to synchronize with.
The host detects that a system call has failed.

Choose an Enforcement Method

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

To choose the right NAP enforcement method for your network, review the following sections of this guide to understand the details of how each enforcement method works and determine which method best meets your deployment goals:

You might also consider the following when choosing an enforcement method:

Infrastructure. How well does your current network support the enforcement method?
Cost. Which aspect of your NAP deployment is more important: cost or flexibility?
Complexity. Do you have the expertise to implement and maintain your deployment?
Security. How secure is the enforcement method?

Infrastructure

All NAP enforcement methods can be implemented using a minimum of one computer running Windows Server 2008 R2 or Windows Server 2008. All enforcement methods require that NPS is installed on this computer and configured to evaluate the health of NAP clients. Additional required services depend on the enforcement method. For example, IPsec, VPN, and DHCP enforcement methods require a NAP enforcement server running Windows Server 2008 R2 or Windows Server 2008. The 802.1X enforcement method requires network hardware that supports the 802.1X authentication method and is capable of controlling port characteristics using RADIUS tunnel attributes. For more information, see NAP Configuration Overview.

MCITP Boot camp USA : MCITP CCNA Boot camp UK, MCITP MCSE CCNA Boot camp Asia, MCITP CCNA MCSE Bootcamp, MCITP MCSE RHCE Training

Cost

Because support for it is built into the Windows operating system, the cost of deploying NAP is typically low, but depends on how well your existing network hardware and software support your design. If you have deployed Windows Server 2008 R2 or Windows Server 2008 on your network, then you already have some or all of the components required to deploy NAP. Some NAP enforcement methods might require an upgrade of the components of your network infrastructure. For example, deploying NAP with 802.1X enforcement can be costly if you do not already have hardware that supports 802.1X authentication. If you already have hardware that supports 802.1X, then it is likely that you can deploy NAP with 802.1X enforcement at minimal cost. If your hardware does not support NAP, in some cases adding support can be as simple as downloading and installing new firmware. To determine the costs associated with a NAP deployment, review hardware and software requirements for the enforcement methods you have chosen and determine whether server and network hardware upgrades are required. Additional costs that might also be associated with a NAP deployment include planning and design costs and the training of support personnel.

Complexity

NAP with IPsec enforcement is generally the most complex enforcement method to deploy because it requires a public key infrastructure (PKI) and IPsec policies to create logical networks. However, Windows Server 2008 R2 and Windows Server 2008 include tools for managing and monitoring IPsec that eliminates much of this complexity. The 802.1X enforcement method is next in terms of complexity, followed by VPN enforcement. DHCP enforcement is the least complex enforcement method to deploy.

Security

IPsec enforcement is a powerful method for protecting compliant computers from any others; it can be combined with server and domain isolation to ensure that after a computer has demonstrated it is compliant, it will still be restricted to communicating only with authorized hosts. IPsec provides other benefits, too. Network packets are authenticated, which reduces the risk of man-in-the-middle and replay attacks, and traffic can be encrypted with IPsec, providing a high degree of protection from eavesdropping attacks.

Like IPsec, 802.1X offers a high degree of protection. Several enhancements to 802.1X are also available that provide improved security. Until a client has demonstrated that it complies with the organization�s health requirements, its access to the network will be restricted by the network switches and wireless access points. These restrictions can be very difficult to bypass, even by a determined malicious user.

VPN enforcement is a good choice for protecting remote access to the corporate network. Clients that connect to a NAP-enabled VPN server can be granted restricted access to the network at the point of entry using IP packet filters. The health of remote client computers is evaluated when the client connects and it is monitored during the VPN session. If a client computer becomes noncompliant, then access is restricted until the computer is compliant.

DHCP enforcement restricts noncompliant computers by providing a limited IPv4 address configuration. It is the least secure NAP enforcement method. It is easily bypassed by an advanced user who has administrative privileges on the computer.

Combining NAP enforcement methods

It is possible to use more than one enforcement method simultaneously. An organization might invest additional resources into combining these enforcement technologies because they have complementary strengths and weaknesses. NAP with VPN enforcement can be used to enforce organizational compliance policies on remote clients, while NAP with IPsec enforcement can be used for local clients. 802.1X and IPsec offer a particularly robust combination because together they can restrict network connectivity at multiple layers of the network protocol stack. The following table shows which enforcement methods can be combined. Keep in mind that the complexity of your NAP deployment will increase when you combine enforcement methods.

	IPsec	802.1X	VPN	DHCP
IPsec
802.1X			X
VPN		X		X
DHCP