Live NTP Clock Skew, Stratum & monlist Enumeration Inspector (2026)

When an NTP server allows unrestricted Mode 6 control queries (`ntpq -c rv <target>`), it returns internal system variables including the exact NTP daemon version, operating system (`system="Linux/5.15.0-x86_64"`), CPU architecture (`processor="x86_64"`), jitter, clock offset, and upstream reference server IP.

The legacy `monlist` command in `ntpd` (prior to v4.2.7p26) returns a list of the last 600 client IP addresses that queried the time server. Because UDP is connectionless, an attacker can send a tiny 234-byte spoofed request with the victim's source IP and trigger up to 556.9x bandwidth amplification back at the victim.

Stratum 0 represents hardware reference clocks (cesium/rubidium atomic clocks, GPS GNSS receivers) directly attached via PPS serial lines. Stratum 1 servers attach directly to Stratum 0 hardware. Stratum 2 servers sync over the network from Stratum 1, and so on up to Stratum 15. Stratum 16 indicates an unsynchronized clock.

If a man-in-the-middle (MITM) attacker spoofs unauthenticated UDP port 123 responses, they can roll a victim's system clock backward to make revoked or expired X.509 certificates appear valid, or roll the clock forward into the future to expire HSTS (`Strict-Transport-Security`) max-age pins and DNSSEC RRSIG signatures.

NTS splits time synchronization into two phases: first, an NTS Key Establishment (NTS-KE) handshake over TCP port 4460 using TLS 1.3 to negotiate AEAD keys and opaque cookies; second, authenticated NTP UDP packets on port 123 using those AEAD extension fields without sacrificing nanosecond timestamp precision.