37

Port 37/tcp is registered with IANA as time with the description "Time," assignee Jon Postel, and a blank reference field (dual-registered on TCP and UDP). The Time Protocol is defined in RFC 868 (May 1983, J. Postel and K. Harrenstien): the server returns a 32-bit unsigned binary number giving the number of seconds since midnight on 1 January 1900 GMT. Over TCP the client simply connects to port 37, the server sends the four-byte value and closes the connection; over UDP the client sends an empty datagram and receives a four-byte reply. The IANA reference field is blank. It was meant as a minimal, machine-readable clock source for hosts without a reliable local clock, and it has long been superseded by NTP on port 123, which provides far higher accuracy and security; RFC 868 itself notes the 32-bit base "will serve until the year 2036," when the counter rolls over (7 February 2036). Security-wise, the Time Protocol has no authentication or encryption and is trivially spoofable, and the UDP variant is a minor amplification/reflection vector among the legacy "small services." For an analyst, an open 37 indicates a legacy time-serving host or a network appliance with old small services left enabled — generally benign, but a marker of an unhardened or outdated system, and worth disabling in favor of NTP.

IANA assignment

time — "Time"; reference (blank — no RFC cited in IANA registry); assignee Jon Postel; dual-registered 37/tcp + 37/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low open-frequency in nmap-services (de-facto) [Well-established] — nmap-services file

Related ports

123 (NTP), 13 (daytime), 4 (historical time cluster); 37/udp sibling

Primary use

return seconds-since-1900 as a 32-bit value (RFC 868)

Other/unofficial uses

legacy clock-sync for hosts lacking a local clock [Well-established]

Security implications

no auth/encryption, trivially spoofable; 37/udp is a minor amplification/reflection vector; superseded by NTP; disable

Typically seen on

legacy time-serving hosts, old network appliances with small-services enabled

Analyst note

An open 37 indicates a legacy time-serving host or small-services-enabled appliance; benign but a sign of an unhardened/outdated system. Use NTP instead.

Port 37/udp is registered with IANA as time with the description "Time," assignee and contact Jon Postel, and blank Registration Date / Modification Date / Reference fields (dual-registered on both TCP and UDP, with identical registration data on each). The protocol is defined in RFC 868 (J. Postel and K. Harrenstien, May 1983): a client sends an empty datagram to UDP port 37, and the server responds with a single 32-bit unsigned integer giving the number of seconds since 00:00 (midnight) UTC on 1 January 1900. Under UDP there is no connection setup — one request, one fixed four-byte reply — which makes it a site-independent, machine-readable clock source. Historically it was reachable through the Unix inetd/xinetd internal time service (shipped disabled by default on most systems) and queried with client tools such as rdate, date, and sdate; NIST's Internet Time Service ran port-37 servers alongside NTP. The reason port 37 matters for an analyst today is almost entirely as legacy: it has been superseded by NTP (UDP 123). NIST explicitly recommends against using date/rdate/sdate over port 37, citing poor client error handling that can set a clock to a wildly wrong value — frequently a year in 2036 because the 32-bit second count rolls over on 7 February 2036. The protocol is unauthenticated and offers no integrity or encryption, so responses are trivially spoofable, but its fixed four-byte reply gives it a negligible amplification factor: CISA's UDP-amplification advisory lists DNS, NTP, CharGen, SSDP, SNMP, and Portmap, and does NOT list Time Protocol, so port 37 is not a known reflection/amplification vector. No mass-scanning campaign or CVE specifically targeting 37/udp surfaced in public threat intelligence as of mid-2026; an exposed instance is best read as a legacy or misconfigured host rather than an active attack surface.

IANA assignment

time — "Time"; reference (blank — no RFC cited in IANA registry); assignee/contact Jon Postel; dual-registered 37/tcp + 37/udp with identical data [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)

Range class

well-known (0–1023) [Confirmed]

Current status

largely superseded by NTP (UDP 123); most Unix-like systems moved from rdate/inetd to ntpdate/NTP daemons; NIST advises against port 37 [Confirmed] — NIST ITS firewall page; Wikipedia: Time Protocol

Prevalence

nmap-services observed open-frequency 37/udp ≈ 0.006458 — low (roughly 6 in 1,000 sampled hosts), 86th of 5,615 UDP entries; about twice the 37/tcp figure of ≈ 0.003161. Higher than the protocol's obsolescence would suggest, consistent with inetd-era hosts left running rather than active RFC 868 use

[Likely] — nmap-services dataset

Related ports

NTP (123/udp) as the modern replacement; the small-services cluster (7, 9, 13, 17, 19)

Primary use

RFC 868 Time Protocol over UDP — client sends an empty datagram to port 37; server replies with a 32-bit count of seconds since 00:00 UTC 1 Jan 1900

Other/unofficial uses

NIST Internet Time Service operated port-37 servers alongside NTP; queried by rdate/date/sdate clients [Confirmed] — NIST ITS firewall page (https://www.nist.gov/pml/time-and-frequency-division/time-services/internet-time-service-firewall-information)

Common software

historically the Unix inetd/xinetd internal time service (disabled by default); RFC 868 names no reference implementation

Security implications

unauthenticated and unencrypted (trivially spoofable); 32-bit rollover on 7 Feb 2036 can drive misconfigured clients to erroneous 2036 dates; amplification factor negligible (fixed 4-byte reply) — NOT listed among CISA UDP-amplification protocols [Confirmed] — CISA AA14-017A (https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks); NIST ITS firewall page

Typically seen on

legacy or misconfigured hosts retaining the inetd time service; otherwise an anomaly

Spec security considerations

none — RFC 868 contains no security considerations section [Confirmed] — RFC 868

Analyst note

An open 37/udp is a legacy/misconfiguration signal, not a known amplification or exploitation vector; prefer NTP. No 37/udp-specific CVE or scanning campaign found as of mid-2026.