

That is: When a server replies with stratum 1, it is directly connected to a reference clock. While the reference clock (if one is used) internally has a stratum value of 0, the NTP server that syncs to that clock has a stratum value of 1. stratum: The stratum value gives the distance to the reference clock.Other modes are “symmetric active” (2) between NTP peers and “NTP control message” (6) for controlling/polling NTP servers. This is the basic client-server unicast request which you’ll see all over your network. mode: The most common modes are client (3) and server (4).version: “3-bit integer representing the NTP version number, currently 4.”.leap indicator: “2-bit integer warning of an impending leap second to be inserted or deleted in the last minute of the current month.

Note that I am NOT explaining the NTP algorithm at all, but only the packets and their fields that are present on the network. Looking on the wire you should understand the packet header ( section 7.3 in the RFC). Have a look at the current NTPv “Network Time Protocol Version 4: Protocol and Algorithms Specification” in order to understand the packets and protocol details.
