13
Summary
- // if you see it open
- 13/udp is a recognized amplification/reflection DDoS vector (a small-service UDP responder that floods a spoofed victim). TCP daytime is NOT a reflection vector because TCP requires a handshake. Disable as part of small-services hardening; use NTP for real time service.
- // common applications
- historical only
- // analyst note
- An open daytime indicates legacy/small-services exposure; close it (NTP is the robust modern alternative for time).
About port 13/tcp.
Port 13/tcp is registered with IANA as daytime with the description "Daytime" and, distinctively for this batch, a populated reference field of [RFC867] — the only one of these eight low ports whose IANA row cites its RFC; the assignee is Jon Postel and it is dual-registered on TCP and UDP. The Daytime Protocol, defined in RFC 867 (Postel, May 1983), returns the current date and time as a human-readable ASCII string and ignores any input: on TCP the server sends the string and closes the connection, and on UDP it answers each received datagram with one daytime datagram. It was meant as a simple, eyeball-friendly time service; for machine-usable timestamps the companion Time Protocol (RFC 868, port 37) and later NTP are the right tools. Because daytime is one of the UDP "small services" that replies to a small request with a response, 13/udp is a recognized amplification/reflection DDoS vector, used like the other small-service responders to flood a spoofed victim — though the TCP daytime service is not a reflection vector, since TCP's handshake prevents trivial source-address spoofing. These services were historically enabled by default in inetd and on Cisco IOS, and current guidance (and defaults) is to disable them. For an analyst, an open daytime indicates a legacy or small-services-enabled host; it should be closed, with NTP as the robust modern alternative for time.
- IANA assignment
daytime— "Daytime"; reference [RFC867]; assignee Jon Postel; dual-registered 13/tcp + 13/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 13/tcp ≈ 0.003927; 13/udp ≈ 0.004827 (de-facto) [Well-established] — nmap-services file
- Related ports
- 37 (time, RFC 868), 123 (NTP); the small-services cluster 7/9/11/17/19; 13/udp sibling
Primary use
return current date/time as a human-readable ASCII string (RFC 867)
Other/unofficial uses
legacy time-check utility; Cisco IOS daytime returns system time if the clock is set [Well-established]
Security implications
13/udp is an amplification/reflection DDoS vector (small-service responder); TCP daytime is NOT a reflection vector (handshake required); disable as part of small-services hardening
Typically seen on
legacy Unix, Cisco IOS small-servers, embedded devices
- Analyst note
- An open daytime indicates legacy/small-services exposure; close it (NTP is the robust modern alternative for time).
About port 13/udp.
Port 13/udp is registered with IANA as daytime with the description "Daytime," assignee and contact Jon Postel, and the reference field [RFC867] (dual-registered identically on 13/tcp and 13/udp). The Daytime Protocol is defined in RFC 867 (J. Postel, ISI, May 1983): a UDP server listens on port 13, and upon receiving any datagram it replies with a single line containing the current date and time as a human-readable ASCII string, ignoring the contents of the incoming datagram entirely. There is no authentication and no session state. RFC 867 itself frames daytime as a debugging and measurement aid rather than a machine timekeeping mechanism, pointing to the Time Protocol (RFC 868) and — in modern practice — NTP (port 123/udp), which displaced it for production time synchronization. For an analyst, port 13 is essentially a small-services artifact: it historically shipped in the BSD/Unix inetd and xinetd super-server suites, was enabled by default on older distributions, and is exposed on NIST's time.nist.gov for legacy clients, but no widely used modern application depends on it. A responsive 13/udp is therefore usually a legacy or misconfigured host rather than a live service. The security concerns are characteristic of the small UDP services: the response leaks the host's timezone and aids OS fingerprinting; because the service answers any datagram with no source-address validation it can act as a trivial UDP reflector, though the short (~30–50 byte) ASCII reply makes its amplification factor low relative to DNS, NTP, or CharGen; and the classic loopback hazard of routing daytime (port 13) output into echo (port 7) can produce a packet storm between two hosts. Standard guidance from multiple sources is to disable it at the firewall unless specifically required.
- IANA assignment
daytime— "Daytime"; reference[RFC867]; assignee/contact Jon Postel[Jon_Postel]; dual-registered 13/tcp + 13/udp (identical assignments) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)- Range class
- well-known (0–1023) [Confirmed]
- Registration/modification date
- blank in the IANA registry (no date published; no date fabricated) [Confirmed] — IANA CSV registration/modification columns
- Status
- legacy/obsolete; displaced by NTP (123/udp) for time synchronization; enabled by default only on very old inetd configurations [Confirmed] — RFC 867; Rapid7 "Adventures in Empty UDP Scanning" (2014)
- Related ports
- the small-services cluster (7, 9, 11, 17, 19, 37); RFC 868 Time Protocol; NTP 123/udp as the modern replacement
Primary use
Daytime Protocol (RFC 867) — server replies to any UDP datagram with the current date/time as a single-line ASCII string; debugging/measurement aid, not machine timekeeping
Other/historical uses
bundled in BSD/Unix inetd/xinetd super-server suites (default-on on older OS distributions); exposed on NIST time.nist.gov for legacy clients
Security implications
information disclosure (reveals timezone, aids OS fingerprinting); usable as a trivial UDP reflector since it answers any datagram with no spoofing protection, but amplification is low because the reply is a short ASCII string; classic daytime(13)→echo(7) loopback packet-storm hazard; a response confirms an active host (recon). No CVEs specific to 13/udp daytime were identified; CISA's 2014 UDP-amplification advisory did not list daytime among its named vectors (DNS, NTP, SNMP, CharGen)
Typically seen on
legacy Unix/BSD hosts running inetd/xinetd, NIST legacy time endpoints; otherwise an anomaly worth investigating
- Analyst note
- A responsive 13/udp is statistically rare on modern systems — treat it as a legacy/misconfiguration signal, note the reflector and timezone-disclosure exposure, and recommend disabling unless a legacy client specifically requires it.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| daytime | UDP | — | 0.48% |
| daytime | TCP | — | 0.39% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.