{{ summaryHeading }} {{ summaryPrimary }} {{ summaryLine }}
Values with ns, us, ms, or s suffixes are normalized to milliseconds; bare values use milliseconds.
{{ sourceStatus }}
Auto reports the resolved format in the peer ledger. Pin the producer when column positions must be enforced.
The default 50 ms is a broad infrastructure triage gate, not a universal NTP standard.
ms
A value exactly equal to the gate remains inside policy.
ms
Use the tier expected for the host or site under review.
stratum
Use Ignore for exported rows that never carried daemon selection state.
Blank is neutral. The label is used only in filenames and document subtitles.
SeverityPeerFindingEvidenceNext checkCopy
{{ row.severity }}{{ row.peer }}{{ row.finding }}{{ row.evidence }}{{ row.next_check }}
PeerOffsetJitter/errorStratumReachSource stateStatusParserCopy
{{ row.peer }}{{ formatMilliseconds(row.offset_ms) }}{{ formatMilliseconds(row.uncertainty_ms) }}{{ row.stratum == null ? 'n/a' : row.stratum }}{{ row.reach || 'n/a' }}{{ row.source_state }}{{ row.status }}{{ parserLabel(row) }}
{{ !chartRows.length ? 'Enter valid inputs to render the chart.' : chartLoading ? 'Loading chart. CSV data is available.' : chartError }}
NTP Config Generator Generate NTP configuration for Linux daemons or Cisco devices with source compatibility checks and warnings for unsafe fallback settings.
RADIUS Client Config Generator Build FreeRADIUS client stanzas from NAS rows with device-specific secret checks, address-scope warnings, and hardened security settings.
Audit Log Anomalies Analyzer Rank suspicious audit events from common log and CloudTrail exports using transparent signals for failures, source shifts, and privilege changes.
VLAN Config Consistency Checker Compare switch VLAN evidence with intended trunk and native rules plus database, reserved-VLAN, and VLAN 1 policy before a change.

A host clock can be only a few milliseconds away from its source and still have warning signs in the surrounding evidence. Offset, uncertainty, reachability, source selection, and stratum describe different parts of time synchronization, so none should be read alone.

Network Time Protocol (NTP) daemons compare the local clock with upstream peers and choose one or more sources for clock discipline. The reported offset estimates how far the local clock differs from a peer. Jitter, error, or standard deviation describes instability or uncertainty around that estimate, depending on the command that produced the row.

Field What it says What it cannot prove alone
Offset Estimated signed difference between the host clock and a peer That the peer is correct or currently selected
Jitter or error Variation or uncertainty associated with the measurement The cause of an unstable path
Stratum Distance in the NTP reference hierarchy Accuracy, quality, or trustworthiness by itself
Reach An octal register summarizing recent poll responses Long-term network reliability
Selection marker How the daemon currently treats the source That the whole host clock is healthy

The acceptable offset depends on the workload. Authentication windows, distributed traces, database ordering, and incident timelines may need tighter tolerances than an ordinary workstation, so a policy gate should reflect the system rather than a universal NTP pass mark. One snapshot is also temporary evidence: poll history, network delay, virtual-machine time sources, leap handling, and daemon state can all change after the row was captured. Confidence grows when a valid selected source remains stable over time and agrees with the host’s broader synchronization status.

How to Use This Tool:

Use evidence from one host and set gates that match the timing tolerance of the service being investigated.

  1. Paste NTP or chrony output, load a text file, or start from a sample. Choose Auto detect unless you need to pin a specific parser.
  2. Set the Offset gate and Jitter or error gate in milliseconds, then choose the highest expected stratum from 1 through 15.
  3. Select how source markers should be handled. Require when markers are present expects a selected source only when the input contains marker evidence; Require a selected marker always expects one.
  4. Check skipped-line warnings before trusting the peer rows. A wrong source format can silently turn useful evidence into parser warnings.
  5. Read the worst finding first, then compare the affected peer with the daemon’s complete status and recent logs before changing time-service policy.

Interpreting Results:

The overall label is the most severe finding across all parsed peers and input-level checks. Within gates means no configured rule fired; it is not an independent measurement of clock accuracy.

  • Unsynchronized is reserved for a Critical finding, including stratum 16 or higher.
  • Action required reflects a High finding such as zero reach, a falseticker or unusable marker, a missing required selected source, or a large gate breach.
  • Review reflects a Warning such as partial reach, a smaller gate breach, a higher-than-expected stratum, excessive variability, or skipped input lines.

Technical Details:

NTP and chrony commands use related terminology but different row layouts and sometimes different time units. The analysis first converts supported rows into a common peer record, then applies operator-selected gates and daemon-state rules.

Transformation Core

Auto detection recognizes ntpq peers, chronyc sources, chronyc sourcestats, CSV, and plain peer rows. CSV header aliases map peer, offset, uncertainty, stratum, marker, reach, and delay fields. Time values are converted to milliseconds before comparison.

Input unit Conversion to milliseconds
Nanoseconds Divide by 1,000,000
Microseconds Divide by 1,000
Milliseconds or no suffix Use the value as milliseconds
Seconds Multiply by 1,000

Formula Core

Gate checks use absolute offset, while the peer ledger retains the original sign. The summary reports the largest absolute offset and the largest uncertainty among parsed peers.

ai = |oi| , omax = maxi (ai)

Here, oi is peer i’s signed offset in milliseconds, ai is its absolute offset, and omax is Worst offset. Values are not rounded before rule evaluation; display formatting may shorten them.

Rule Core

Exact gate equality remains clear because gate breaches use the greater-than operator. High escalation begins at an inclusive secondary boundary.

Evidence Warning or review condition High or critical condition
Absolute offset a a > offset gate a ≥ max(4 × offset gate, 1,000 ms) is High
Jitter or error u u > uncertainty gate u ≥ max(3 × uncertainty gate, 1,000 ms) is High
Stratum s s > expected maximum s ≥ 16 is Critical
Reach register A nonzero octal string other than exactly 377 Any octal representation of zero is High
Source marker ~ is Warning x or ? is High

The selected markers are * and o. Under the conditional policy, a selected source is required only when at least one row contains a marker. Under the always-required policy, zero selected rows creates a High finding even when no markers were supplied. Any non-header line that the chosen parser cannot read adds a Warning.

Input is limited to 200,000 characters and 500 parsed peer rows. Offset and uncertainty gates accept 0 through 600,000 ms. A zero gate is valid, so any positive absolute offset or uncertainty breaches it.

Privacy and Accuracy Notes:

Pasted and uploaded evidence is parsed in the browser and is not sent to a server for analysis. Remove hostnames or addresses that should not appear in screenshots or downloaded evidence.

  • The thresholds and severity escalation are operator policy, not limits defined by NTP or chrony.
  • Different commands use “jitter,” “error,” and “standard deviation” for related but not identical quantities; comparison is strongest when source format and command stay consistent.
  • Confirm findings with the full daemon report, system synchronization state, and repeated observations before correcting the clock or changing sources.

References: