NTPDIG(1)

💖 NTPDIG(1) — the manual page, but make it make sense 💖

okay bestie, so this is ntpdig, from the NTPsec fam. It's the standard Simple Network Time Protocol client program, and honestly? It's giving "I just want to know what time it is" main character energy. Let's get into it 🕐✨

---

✨ SYNOPSIS ✨

ntpdig
    [--help | -?] [-4 | -6] [-a keynum] [-p samples]
    [-c] [-d] [-D debug-level] [-g delay] [-I ipaddr] [-j]
    [-k keyfile] [-l logfile] [-M steplimit] [-S] [-s]
    [--wait] [--no-wait] [--version] [address...]+

---

🌸 DESCRIPTION 🌸

So basically, ntpdig is an SNTP client. You point it at an NTP or SNTP server and it'll either just show you the time or, if you've got the right privileges, actually set your local system's time. She can run as an interactive command or as a cron job, she's flexible like that 💅

NTP (Network Time Protocol) and SNTP (Simple Network Time Protocol) are defined and described by RFC 5905. Slay, specification queen.

By default she writes the estimated correct local date and time — that's local, not UTC, bestie, read carefully — to standard output, in a format that looks like this:

2015-10-14 13:46:04.534916 (+0500) -0.000007 +/- 0.084075 localhost 127.0.0.1 s2 no-leap

Let's decode this lil beauty together 💖

• (+0500) means the reported local time is 5 hours and 0 minutes ahead of UTC.
• -0.000007 means your local clock is 0.000007 seconds ahead of the correct time — so you'd subtract 0.000007 seconds from the local clock to make it correct. Also heads up: the number of decimals printed for this value changes based on the reported precision of the server. It's not fixed, it's adaptive, she's doing her best.
• +/- 0.084075 is the reported synchronization distance, in seconds, which represents the maximum error due to all causes. And if the server doesn't report valid data needed to calculate the synchronization distance, this gets reported as +/- ?. Not a vibe but okay.

If the host is different from the IP, both get displayed. Otherwise? Only the IP shows up. And finally, the stratum of the host is reported and the leap indicator is decoded and displayed. Full transparency, periodt.

Now. With the -j (JSON) option, the output format becomes a self-describing JSON record:

{"time":"2015-10-14T13:46:04.534916+0500",
         "offset":-0.000007,"precision":"0.084075",
         "host":"localhost",ip:"127.0.0.1",
         "stratum":2,"leap":"noleap","adjusted":false}

In the JSON format:

• time is in ISO 8601 format.
• precision is the synch distance, with an unknown synch distance being reported as 0.
• host and ip are always emitted even if duplicate. No skipping, no deduping, she said what she said.
• The "adjusted" boolean reports whether ntpdig determined it should have slewed or stepped the time. And lowkey important: this may be shown as true even if time was not actually adjusted, due to lack of clock-setting privileges. So don't come for her, she's just reporting her intentions 🫶

---

💅 OPTIONS 💅

• -h, --help — Displays usage information and exits. The classic "bestie explain urself" move.
• -4, --ipv4 — Force IPv4 DNS name resolution. This option must not appear in combination with any of the following options: ipv6. What it does: force DNS resolution of the following host names on the command line to the IPv4 namespace. IPv4 only, no sharing the spotlight.
• -6, --ipv6 — Force IPv6 DNS name resolution. This option must not appear in combination with any of the following options: ipv4. What it does: force DNS resolution of the following host names on the command line to the IPv6 namespace. the future is now ✨
• -a auth-keynumber, --authentication=auth-keynumber — Enable authentication with the key auth-keynumber. This option takes an integer number as its argument. It enables authentication using the key specified in this option's argument. That argument is the keyid, a number specified in the keyfile as this key's identifier. See the keyfile option (-k) for more details. Keyed and locked 🔐
• -c host-name, --concurrent=host-name — Concurrently query all IPs returned for host-name. This option may appear an unlimited number of times. Okay so listen: requests from an NTP "client" to a "server" should never be sent more rapidly than one every 2 seconds. By default, any IPs returned as part of a DNS lookup are assumed to be for a single instance of ntpd, and therefore ntpdig will send queries to these IPs one after another, with a 2-second gap in between each query. The -c or --concurrent flag says that any IPs returned for the DNS lookup of the supplied host-name are on different machines, so we can send concurrent queries. This is appropriate when using a server pool. Group chat moment 🎀
• -d, --debug-level — Increase debug verbosity level. This option may appear an unlimited number of times. More -d, more tea.
• -D number, --set-debug-level=number — Set the debug verbosity level. This option may appear an unlimited number of times. This option takes an integer number as its argument. You're setting it, not layering it.
• -g milliseconds, --gap=milliseconds — The gap (in milliseconds) between time requests. This option takes an integer number as its argument. The default milliseconds for this option is 50. It separates the queries we send out by the specified number of milliseconds. A larger delay reduces the query load on the time sources, at the cost of increasing the time to receive a valid response if the first source attempted is slow or unreachable. Choose your fighter ⚖️
• -I, --bindaddr=IP_Addr — Bind to Specified IP for requests. Binds to the specified IP address for requests before the request is made. This can be useful for systems with multiple interfaces. Multi-homed girlies, this one's for you.
• -j — Output to stdout in JSON, suppressing syslog messages. Strictly structured, no chatter 💅
• -k file-name, --keyfile=file-name — Look in this file for the key specified with -a. This option specifies the keyfile. ntpdig will search for the key specified with -a keyno in this file. See ntp.keys(5) for more information. Go read it, iykyk.
• -l file-name, --logfile=file-name — Log to specified logfile. This option causes the client to write log messages to the specified logfile. Receipts, on file 📝
• -M number, --steplimit=number — Adjustments less than steplimit milliseconds will be slewed. This option takes an integer number as its argument. The value of number is constrained to being greater than or equal to 0. If the time adjustment is less than steplimit milliseconds, slew the amount using adjtime(2). Otherwise, step the correction using clock_settime() or local equivalent. The default value is 0, which means all adjustments will be stepped. This is a feature, as different situations demand different values. Not a bug, bestie, it's intentional 🫶
• -p, --samples — The number of samples to take (default 1). The best one (chosen by, among other criteria, sync distance) is selected for display or use. She's ranking them and only the winner gets the crown 👑
• -S, --step — By default, ntpdig displays the clock offset but does not attempt to correct it. This option enables offset correction by stepping, that is, directly setting the clock to the corrected time. This typically requires ntpdig be invoked as the superuser ("root"). Big power, big responsibility ⚡
• -s, --slew — By default, ntpdig displays the clock offset but does not attempt to correct it. This option enables offset correction by slewing using adjtime(), which changes the rate of the clock for a period long enough to accomplish the required offset (phase) correction. This typically requires ntpdig be invoked as the superuser ("root"). Gentle nudge instead of a shove 🌊
• -t seconds, --timeout=seconds — The number of seconds to wait for responses. This option takes an integer number as its argument. The default seconds for this option is: 5. When waiting for a reply, ntpdig will wait the number of seconds specified before giving up. The default should be more than enough for a unicast response. If ntpdig is only waiting for a broadcast response, a longer timeout is likely needed. Don't rush her, but also, don't wait forever.
• --wait, --no-wait — Wait for pending replies (if not setting the time). The no-wait form will disable the option. This option is enabled by default. If we are not setting the time, wait for all pending responses. Patience is a virtue ✨
• --version — Output version of program and exit. Knowing exactly what you're running? iconic.

---

🦋 USAGE 🦋

• ntpdig ntpserver.somewhere is the simplest use of this program and can be run as an unprivileged command to check the current time and error in the local clock. Baby's first NTP query 🍼
• ntpdig -S -s -M 128 ntpserver.somewhere With suitable privilege, run as a command or from a cron(8) job, ntpdig -Ss -M 128 ntpserver.somewhere will request the time from the server, and if that server reports that it is synchronized then if the offset adjustment is less than 128 milliseconds the correction will be slewed, and if the correction is more than 128 milliseconds the correction will be stepped. Pick a lane based on how bad it is, honestly.
• ntpdig -S ntpserver.somewhere With suitable privilege, run as a command or from a cron(8) job, ntpdig -S ntpserver.somewhere will set (step) the local clock from a synchronized specified server, like the ntpdate utility from older NTP implementations. Retro but make it modern 💜

---

🎀 COMPATIBILITY 🎀

Heads up, not all options of the NTP classic sntp(1) utility have been retained. Don't expect -b, -K, -o, -r, -w, or -W to work. These have either been removed for security reasons or discarded as unnecessary in a modern environment. They're gone, she doesn't do that anymore, let it go 💀

This version does not log to syslog. Pipe standard output and standard error to logger(1) if you want this behavior. DIY queen.

The synchronization-distance formula used in this version is slightly different from that found in sntp(1), tracking the newer formula used in ntpd(8). Expect offset computations to match but synch-distances not to. Yes really, they diverge. That's the note. That's the whole note 📝

⚠️ Real talk: that compatibility caveat about synch-distances not matching is not a typo and not a bug report — it's documented behaviour. Plan accordingly, bestie.

---

🌈 AUTHORS 🌈

Johannes Maximilian Kuehn, Harlan Stenn, Dave Hart. Legends, honestly. Thank you for your service 🫡💖

---

⭐ EXIT STATUS ⭐

One of the following exit values will be returned:

• 0 (EXIT_SUCCESS) — Successful program execution. It ATE. No crumbs left. 🎉
• 1 (EXIT_FAILURE) — The operation failed or the command syntax was not valid. It's giving 💀. Check your flags and try again.

---

and that's the whole page, bestie!! you made it to the end, I'm so proud of you 🥹💖

this gorgeous lil manual came to you from NTPsec, dated 2026-10-21. go forth and sync those clocks ✨🕐👑