ntpsec-rs-dig — ntpdig-rs
NTP mode 3 (client) query tool — a drop-in replacement for ntpdig from NTPsec.
Part of the ntpsec-rs workspace — a forensic Rust reconstruction of NTPsec. Version 0.3.48.
Overview
ntpdig-rs is a simple, single-shot NTP query tool that sends NTP mode 3
(client) packets to a remote NTP server and displays the response. It is the
Rust equivalent of the ntpdig tool from NTPsec, used for quickly checking
the time offset, delay, and jitter against an NTP server.
The tool resolves the server hostname (or uses an IP directly), sends one or more NTP queries, and displays the server's reported time, offset, delay, and dispersion.
Usage
Basic Query
Output:
ntpdig-rs v0.3.48 — NTP query tool (Rust)
Querying pool.ntp.org:123
remote refid st t when poll reach delay offset jitter
==============================================================================
*pool.ntp.org .GPS. 2 u - 64 1 12.345 0.456 0.789
time: 2025-01-15T12:34:56Z, clock offset: 0.000456s
Multiple Samples
Queries the server 4 times and displays the aggregated result. Useful for measuring jitter and establishing confidence in the offset estimate.
Verbose Output
Shows additional details:
Verbose details:
Root delay: 0.003125 s
Root dispersion: 0.001234 s
Precision: 2^-24 (0.0000000596 s)
Leap indicator: NoWarning
Round-trip delay: 0.012345 s
Dispersion: 0.000789 s
Force IPv4 or IPv6
Custom Port
Custom Timeout
Command-Line Flags
| Flag | Description |
|---|---|
server |
NTP server to query (hostname or IP) |
-4 |
Force IPv4 only |
-6 |
Force IPv6 only |
-v, --verbose |
Verbose output with detailed timing information |
-t, --timeout <secs> |
Query timeout in seconds (default: 5) |
-p, --port <port> |
Server port number (default: 123) |
-s, --samples <n> |
Number of NTP samples to take (default: 1) |
DNS Resolution
The tool performs DNS resolution of the server hostname, supporting both A
(IPv4) and AAAA (IPv6) records. The address family can be restricted with
-4 or -6.
NTS Support
NTS (Network Time Security) support for authenticated time queries is planned,
building on the NTS client infrastructure in ntpsec-rs-core. When enabled,
ntpdig-rs will:
- Perform an NTS-KE handshake over TCP on port 4460
- Obtain encrypted NTS cookies
- Send NTP queries with NTS extension fields
- Verify NTS authenticators on responses
Output Interpretation
| Field | Description |
|---|---|
remote |
NTP server hostname or IP address |
refid |
Server's reference identifier (clock source) |
st |
Server stratum (1 = primary, 2-15 = secondary, 16 = unsynchronized) |
t |
Peer type (u = unicast, b = broadcast, l = local) |
when |
Seconds since last packet (shown as - for single query) |
poll |
Poll interval in seconds |
reach |
Reachability register (octal) |
delay |
Round-trip delay in milliseconds |
offset |
Clock offset in milliseconds |
jitter |
Dispersion/jitter in milliseconds |
time |
Server-reported reference time (ISO 8601) |
clock offset |
Computed clock offset in seconds |
Related Crates
All crates in the ntpsec-rs workspace on crates.io:
| Crate | Description | crates.io |
|---|---|---|
| ntpsec-rs-core | Deterministic engine, wire codec, Mode 6, auth, refclocks, NTS |  |
| ntpsec-rs-io | Real I/O layer (system clock, network, state store) |  |
| ntpsec-rs | Umbrella facade crate |  |
| ntpsec-rs-d | ntpd-rs — NTP daemon binary |  |
| ntpsec-rs-query | ntpq-rs — Mode 6 query client |  |
| ntpsec-rs-dig | ntpdig-rs — NTP query tool |  |
| ntpsec-rs-keygen | NTP key generation |  |
| ntpsec-rs-leapfetch | Leap second file fetcher |  |
| ntpsec-rs-mon | Real-time NTP monitoring tool |  |
| ntpsec-rs-trace | NTP path trace tool |  |
| ntpsec-rs-wait | Wait until NTP server reachable |  |
| ntpsec-rs-viz | NTP data visualization |  |
| ntpsec-rs-frob | NTP configuration manipulator |  |
| ntpsec-rs-snmpd | SNMP monitoring daemon |  |
| ntpsec-rs-time | Single-shot time query tool |  |
| ntpsec-rs-sweep | Sweep through servers collecting stats |  |
| ntpsec-rs-loggps | GPS reference clock logging |  |
| ntpsec-rs-logtemp | System temperature logging |  |