123
Summary
- // if you see it open
- All meaningful NTP security context is UDP-specific. NTP amplification DDoS via the 'monlist' command (historically >500x amplification; disabled by default since ntpd 4.2.7), time-shifting/spoofing attacks, and CVEs including CVE-2014-9295 (Kiss-of-Death DoS), CVE-2015-5194 (ntpq buffer overflow), CVE-2016-1547 (authentication bypass), and CVE-2019-8936 (memory leak). RFC 9109 (2021) recommends client ephemeral source-port randomization (addresses CVE-2019-11331). NTS (Network Time Security) over TLS is the emerging hardening standard (Cloudflare public NTS; chrony NTS by default). None of these are TCP-specific; standard guidance is to filter TCP 123 at the perimeter.
- // analyst note
- Treat 123/tcp traffic as anomalous — real NTP is UDP-only, so connection attempts on 123/tcp warrant investigation as scan noise or misconfiguration rather than legitimate service.
About port 123/tcp.
Port 123 is registered with IANA under the service name ntp ("Network Time Protocol"), assignee and contact [Dave_Mills], with [RFC5905] cited in the Reference column and a dual registration that covers both 123/tcp and 123/udp; the registry's Registration Date and Modification Date columns are blank. The operational reality, however, is that NTP runs almost exclusively over UDP — 123/udp carries essentially all real-world time-synchronization traffic, while the TCP registration on port 123 is a formality that the reference daemon and the common alternatives do not use. The major implementations — ntpd (the reference implementation), chrony, and OpenNTPD — all bind and communicate over 123/udp only, so there is no widely deployed software that listens on 123/tcp. An IETF NTP working-group draft proposes a future TCP listener framework for ancillary functions such as monitoring, control, and ephemeral key exchange, but as of 2025 it remains a draft with "TBD" IANA considerations and no deployed implementations. For an analyst, the practical takeaway is that legitimate NTP exposure is a UDP concern: SYN or connection attempts to 123/tcp are typically scanner noise or misconfiguration probing rather than real time traffic, and standard guidance is to filter TCP 123 at the perimeter outright. The meaningful security history all attaches to 123/udp — NTP amplification DDoS via the monlist command (historically over 500x amplification, disabled by default since ntpd 4.2.7), time-shifting and spoofing attacks, and a cluster of CVEs including CVE-2014-9295 (Kiss-of-Death DoS), CVE-2015-5194 (ntpq buffer overflow), CVE-2016-1547 (authentication bypass), and CVE-2019-8936 (memory leak). RFC 9109 (2021) recommends client-side ephemeral source-port randomization to blunt off-path blind attacks (addressing CVE-2019-11331). None of these are TCP-specific. NTS (Network Time Security) over TLS is the emerging hardening standard — Cloudflare runs a public NTS service and chrony ships NTS support by default.
- IANA assignment
ntp— "Network Time Protocol"; reference[RFC5905]; assignee and contact[Dave_Mills]; dual-registered 123/tcp + 123/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Registration/modification date
- blank in the IANA registry (not fabricated) [Confirmed] — IANA registry CSV (Registration Date / Modification Date columns empty for this row)
- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- 13/tcp+udp (daytime), 37/tcp+udp (time); contrast NTS/TLS hardening of modern time sync
Primary use
TCP port 123 is formally assigned to NTP but is operationally unused; real NTP traffic runs over 123/udp (RFC 5905)
Common software
none binds 123/tcp; ntpd, chrony, and OpenNTPD all use 123/udp exclusively; an IETF NTP TCP-services draft proposes future TCP support (TBD IANA considerations, no deployed software as of 2025)
Exposure/scanning notes
TCP SYN/connection attempts to port 123 are typically scanner noise or misconfiguration probes, not authentic NTP; guidance is to filter TCP 123 at the perimeter since NTP only uses UDP
Security implications (UDP-specific)
NTP amplification DDoS via monlist (historically >500x; disabled by default since ntpd 4.2.7), time-shifting/spoofing, and CVE-2014-9295, CVE-2015-5194, CVE-2016-1547, CVE-2019-8936; none are TCP-specific
- Hardening
- RFC 9109 (2021) recommends client ephemeral source-port randomization (addresses CVE-2019-11331); NTS (Network Time Security) over TLS is the emerging standard — Cloudflare public NTS, chrony NTS-by-default [Confirmed] — RFC 9109
- Analyst note
- Treat 123/tcp traffic as anomalous — real NTP is UDP-only, so connection attempts on 123/tcp warrant investigation as scan noise or misconfiguration rather than legitimate service.
About port 123/udp.
Port 123/udp is the IANA-assigned home of the Network Time Protocol, the service that synchronizes clocks across packet networks to within milliseconds of UTC. Accurate time is quietly foundational: log correlation, TLS certificate validity windows, Kerberos ticket lifetimes, database replication, and forensic timelines all depend on it. NTP uses a hierarchical "stratum" model and a four-timestamp exchange over UDP to compute clock offset and round-trip delay without requiring reliable delivery; NTPv4 is specified in RFC 5905 (2010), and SNTP is an interoperable lightweight subset using the same packet format and port. The registry attributes the ntp assignment to the protocol's designer, David L. Mills. The defining security issue is NTP amplification/reflection DDoS via the legacy Mode-7 monlist command (CVE-2013-5211, ntpd before 4.2.7p26): because NTP is UDP, source addresses are trivially spoofed, and a single monlist reply returning up to the last 600 client addresses can be hundreds of times larger than the request — Cloudflare measured amplification factors around 200×. For an analyst, an open 123/udp is an NTP server or client; the priorities are testing whether monlist/Mode-7 control queries are answered (the amplification/reflector risk), confirming the host is not an abusable public reflector, and checking the daemon version. Mitigations include upgrading to ntpd 4.2.8p15+, disabling monitor/noquery, edge rate-limiting, and BCP 38 ingress filtering; NTS (RFC 8915, on 4460/tcp) adds authentication against on-path clock tampering.
- IANA assignment
ntp— "Network Time Protocol"; reference [RFC5905]; contact Dave Mills [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.330879 — one of the most common open UDP ports (4th in published UDP rankings behind 631, 161, 137) [Well-established] — nmap-services file
- Related ports
- 4460/tcp NTS-KE; 37 legacy Time protocol
Primary use
clock synchronization to within milliseconds of UTC across packet networks
Other/unofficial uses
SNTP (same port, simplified algorithm) for IoT/embedded; NTP control queries (Mode 6/7)
Security implications
NTP amplification/reflection DDoS via Mode-7 monlist (CVE-2013-5211); ~200× amplification (Cloudflare); UDP source spoofing; on-path clock shifting. Mitigate via ntpd 4.2.8p15+, disable monitor/noquery, edge rate-limiting, BCP 38; NTS (RFC 8915) adds auth
Typically seen on
dedicated time servers, routers/switches, domain controllers, and virtually all networked devices acting as clients
- Analyst note
- Open 123/udp is an NTP server or client. Test whether
monlist/Mode-7 control queries are answered (amplification/reflector risk), confirm it is not an abusable public reflector, and check the daemon version.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ntp | UDP | Network Time Protocol | 33.09% |
| ntp | TCP | Network Time Protocol | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.