Network time, opened at the seam
The Half You Have to Assume
Four timestamps can compute NTP's clock-offset estimate and round-trip delay. On one fixed two-way path, they cannot by themselves separate clock offset from unequal one-way delay. Set the hidden clock and both legs, then hold every observed timestamp still while the possible truth moves underneath it.
There is a clock here that you cannot see directly. There is a path out and a path back. You may time the whole journey perfectly. The missing fact is how much of that journey belonged to each direction.
Build an exchange
The lower clock is ahead of the upper clock by the hidden offset. Choose that offset and both one-way delays. The apparatus strikes all four timestamps and applies the RFC 5905 equations live.
Computing the exchange.
The residence time cancels. The asymmetry does not. The estimate error is exactly half the outward delay minus the return delay. A symmetric path makes the estimate exact in this ideal exchange. An asymmetric path can make a clean-looking estimate wrong.
The objection: engineer harder
Average more samples. Keep only the lowest-delay packet. Ask several servers and intersect their uncertainty intervals. Those are sensible tools against noise and faulty sources. Now give every tool the same missing fact.
Those are two independent equations for three unknowns:
theta, d_out, and d_back. The next instrument
does not merely say that a degree of freedom remains. It lets you move it.
| sample | T1 | T2 | T3 | T4 | round trip |
|---|
Moving this control changes the possible physical clock offset and one-way delays, but leaves every observed timestamp and every estimator unchanged.
Three servers, one shared directional trunk
Each model server adds a different symmetric access delay after the same asymmetric trunk. The endpoint sweep below finds the interval covered by the greatest number of server intervals. This is the exact Marzullo maximum-overlap operation on the displayed intervals.
| server | minimum round trip | offset interval |
|---|
…
Computing the ambiguity family.
The estimators are not broken. They answer the questions the evidence can answer. Repetition can shrink random scatter. Minimum filtering can discard added queue time. Multiple servers can expose disagreement when their errors differ. In this apparatus, every server inherits the same directional ambiguity, so agreement is not new information.
The check
The browser has recomputed the exchange, the full sample log, all estimator outputs, the ambiguity endpoints, and the interval sweep. The repository verifier performs the same work independently and also checks arbitrary offsets, delays, sample counts, and jitter amplitudes.
- Protocol fact. RFC 5905 specifies the four timestamps and the displayed offset and delay equations. RFC 8915 states that the offset formula relies on network latency being roughly symmetric.
- Derived, not separately assumed. Substitution into those equations produces the half-asymmetry bias and the one-dimensional ambiguity family. No empirical claim is needed for that algebra.
- Model choices. The apparatus uses milliseconds, a fixed remote residence time of …, a stationary clock offset, exact timestamping, nonnegative symmetric queue jitter, and model servers sharing one directional trunk. Symmetric jitter makes the residual especially clean. Real queue jitter is often directional, so real residuals need not vanish.
- Unknown here. The true split between outward and return propagation is not measured. That is the open value represented by the green dot.
Run the machine check from the repository:
node research/the-half-you-have-to-assume/verify-the-half-you-have-to-assume.mjs.
What the boundary does and does not say
It does not say that NTP is generally inaccurate
NTP filters noisy samples, rejects inconsistent sources, tracks oscillator behaviour, and can perform well when path asymmetry is small. A short wired path can be an excellent practical timing path. This page isolates an in-principle identifiability limit. It is not a measurement survey of deployed NTP accuracy.
It applies to one fixed two-way setup with one unsynchronised clock
Reverse the physical direction while directional delays stay stable and reversible, transport a clock with bounded transport-induced offset and drift, calibrate a link whose parameters remain stable, observe a common third clock, or obtain genuinely independent paths and the setup has changed. Those methods add a constraint that the four timestamps did not contain. RFC 8039 discusses multiple paths as a mitigation when their impairments differ.
Why precision systems touch the cable
CERN’s White Rabbit distributes time at sub-nanosecond scale. Its open calibration material records fixed transmit and receive delays and a fibre-asymmetry parameter. That physical calibration is not a cleverer rearrangement of the same timestamps. It is the missing information, measured elsewhere and brought into the calculation.
Ways to bring in an outside reference
NIST describes GNSS common-view as two stations observing the same third clock and exchanging those measurements. A transported clock with bounded transport-induced offset and drift, a link with known stable calibration, or a path swap performed while directional delays stay stable and reversible plays a related structural role. Under those conditions, each creates an observation that distinguishes clock offset from directional delay.
Sources
- RFC 5905, Network Time Protocol Version 4, especially the on-wire equations in section 8.
- RFC 8915, Network Time Security, section 8.6 on asymmetric delay and the symmetry assumption.
- RFC 8039, Multipath Time Synchronization, on stability, symmetry, and independent paths.
- NIST, Common View GNSS Time Transfer.
- Open Hardware Repository, White Rabbit Calibration, with CERN’s description of White Rabbit.
Full citations and the verified-versus-modelled note live in
research/the-half-you-have-to-assume/README.md.