Port 4460Network Time Security Key Establishment (NTS-KE)

TCP 4460 carries the TLS-protected negotiation that provisions keys and cookies for Network Time Security over NTP.

transport: tcp
in transit: encrypted
assignment: official
risk: 3/10
lookups: 0

also known as ntske

Technical Details

what runs on :4460

NTS-KE uses TCP port 4460 and requires TLS 1.2 or later. After the TLS handshake, client and server exchange NTS-KE records to negotiate the next protocol (typically NTP) and an authenticated-encryption algorithm; the server also supplies cookies and the NTP server port. Both sides derive NTS keys from the TLS exporter, then close the TCP connection and use the negotiated parameters in subsequent NTP exchanges, usually over UDP port 123. NTS protects NTP exchanges against tampering and forgery; it does not encrypt the NTP packets themselves.

Security Information

exposure of :4460

risk score

3/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.1 across 372 ports — this one sits 0.1 below.

in transit

encrypted

payloads are protected on the wire

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

The key-establishment exchange is protected by TLS, and the service is intended to be reachable by clients seeking NTS-protected time service. Internet exposure is normal for a public NTS server, but the TLS listener still adds implementation attack surface and can be targeted for connection or resource-exhaustion abuse; keep its TLS stack patched and limit exposure if it is not meant to serve public clients.

Record

iana registry entry

port: :4460
service: Network Time Security Key Establishment (NTS-KE)
transport: TCP
encryption: tls / encrypted
assignment: iana registered
risk: 3/10caution
category: Security Network Services
usage: NTP servers offering Network Time Security (NTS) listen here for clients to establish the security parameters used for NTS-protected time queries. The IANA scan data provided has not observed this port open in internet-wide scans, but this is the standardized port for the service.
lookups: 0rank 993
added: 2026-10-05
updated: 2026-10-05
references: IANA service name registry — port 4460
RFC 8915

Something wrong?

This record is maintained by the engineers who use port 4460. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-10-05.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 372 in security →

the 8 most looked-up other ports in security — 372 ports carry that label.

port	service	proto	category	risk	views
:8881	Atlasz Secure Server	TCP	Web Services	caution	67.6k
:443	HTTPS	TCPtls	Web Services	caution	65.9k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:3268	Microsoft Global Catalog (GC)	TCPUDP	Security	caution	54.6k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:3128	Squid Proxy HTTP	TCP	Web Services	caution	45.8k
:8080	HTTP Alternate	TCP	Web Services	caution	44.9k
:7000	Vuze HTTPS Tracker	TCPtls	Security	caution	28.9k

risk mix of the 8 listed

caution100%

2 of 8 encrypted

Port :4460Network Time Security Key Establishment (NTS-KE)

Technical Details

Security Information

Related Ports

Port 4460Network Time Security Key Establishment (NTS-KE)