ntp trivia

In response to an ntp query about how many servers you should have, someone commented that 3 was sufficient.
This is a (unfortunately) very common misconception. NTP requires *four* servers before avoiding a single point of failure. In reality, the times reported by servers rarely if ever match, so three servers are not sufficient since in all likelihood, none of them will actually match.
NTP gets around this problem by using intervals based on the offset and plus or minus a calculated error. A candidate interval is created using two servers, and any two servers can form such an interval. NTP uses the shortest interval which encloses at least half of the servers. With three servers, this can always be formed no matter how wildly the servers disagree by choosing the interval made by the highest and the lowest server offsets, since the third will always lie between them on the interval.
With four servers, however, if three servers are very close and one is far off the others, the shortest interval will consist of the three in agreement, thus cutting out the bad guy. Of course, since NTP servers often use each other as time sources, it is better to have more servers to avoid the problem of one server contaminating another and cascading failures. But to avoid clock jumps you should have at least four.