Port 123Network Time Protocol

The Network Time Protocol (NTP) enables devices across a network to synchronize their system clocks with high precision. By coordinating time settings between clients and servers, NTP is critical for maintaining accurate timestamps in applications, security protocols, and network management tasks. NTP predominantly uses UDP port 123 due to its low-overhead, connectionless nature, supporting efficient communication for time synchronization across global IP networks..

transport
udp

single transport

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
2/10

safe

lookups
13,239

rank 279 of 993 · top 28%

Technical Details

what runs on :123

Network Time Protocol (NTP) is a widely implemented protocol designed to synchronize the clocks of computers over packet-switched, variable-latency data networks. Operating primarily over UDP port 123, NTP works by exchanging time-stamped packets between a client and one or more NTP servers. The client calculates round-trip delay times as well as local clock offsets, then adjusts its time accordingly for high accuracy.

NTP uses a hierarchical system of strata, where stratum 0 devices (high-precision reference clocks like atomic clocks or GPS receivers) feed time information to stratum 1 servers directly connected to them. Lower strata servers acquire the time indirectly from higher levels. This distributed approach improves resilience and accuracy, providing fault tolerance in case some servers become unreachable or unreliable.

While the core protocol is defined in RFC 5905, NTP implementations commonly support various modes, including client-server, symmetric (peer-to-peer), and broadcast/multicast operation. The protocol periodically updates, correcting for clock drift and variations in network latency, enabling devices to maintain synchronization within milliseconds, even over the public internet.

Security Information

exposure of :123

risk score

2/ 10safe

routine exposure. this port is rarely the way in on its own — keep it patched and logged and move on.

network services averages 3.9 across 604 ports — this one sits 1.9 below.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities:

  • NTP servers can be exploited for amplification in Distributed Denial of Service (DDoS) attacks by sending forged requests (e.g., using the monlist command) that elicit large responses, amplifying the attack traffic directed at victims.
  • Unauthenticated NTP traffic may allow attackers to inject false time information, causing desynchronization that impacts time-sensitive applications and security mechanisms such as Kerberos authentication or log correlation.
  • Outdated or misconfigured NTP servers can harbor software vulnerabilities or allow unwanted information disclosure.

Common Mitigations:

  • Disable legacy and vulnerable commands like 'monlist' on public-facing NTP servers.
  • Implement access controls and rate limiting on NTP servers to restrict who can query them.
  • Employ Network Time Security (NTS), an extension protocol providing cryptographic authentication and encryption of NTP messages.
  • Keep NTP software updated to patch known vulnerabilities.
  • Use reputable upstream time sources and configure redundancy to avoid reliance on a single source.
  • Filter or block external requests to internal NTP servers to prevent them from being abused in amplification attacks.

the 8 most looked-up other ports in network services — 604 ports carry that label.

risk mix of the 8 listed

  • caution100%

0 of 8 encrypted