525
Summary
- // typical exposure
- Internal-only — timed is a legacy LAN-scoped Unix time-synchronization service with no internet-facing design purpose and no maintained modern use case, so it should never be exposed to the public internet.
- // analyst note
- An open port 525/tcp today most likely indicates a legacy Unix host or misconfiguration rather than a currently maintained service; verify against NTP (123) usage before assuming intent.
- // if you see it open
- No CVE identified for the timed protocol/daemon as of an August 2026 search, and no credible source ties 525/tcp to a specific malware family. timed is a LAN-oriented legacy service superseded by NTP on essentially all current systems, so a live listener today is an anomaly worth investigating rather than an expected internet-facing service.
About port 525/tcp.
Port 525/tcp carries timed, a legacy Unix time-synchronization service; it has no legitimate reason to face the public internet and should stay internal-only if it runs at all.
IANA registers 525 on both TCP and UDP for the service name timed with the description "timeserver." The registry lists no assignee, no reference document, and no registration date for this entry. timed (also called timedaemon) is the historical BSD Unix time daemon that let hosts on a local network elect a master clock via the Time Synchronization Protocol (TSP) and nudge participant clocks toward it. TSP is documented in the 4.4BSD paper "Time Synchronization Protocol" by Riccardo Gusella, Stefano Zatti and James M. Bloom, which describes the master/slave scheme and the election the slaves run when the master disappears.
The protocol predates NTP (port 123) and was designed for LAN-scoped clock consensus among Unix hosts, not for internet-facing time distribution. It has been effectively superseded by NTP/xntpd on essentially all current systems, so a live listener on 525/tcp today is unusual and most plausibly a legacy or misconfigured host rather than a deliberately exposed service.
No CVE tied to the timed protocol or daemon turned up in this research, and no credible vendor documentation, blog post, or forum thread names a specific modern application generating traffic on 525/tcp. Measured open-frequency in the nmap-services corpus is low: about 0.0063% for 525/tcp (0.089% for 525/udp), consistent with a rarely-open legacy port.
- Exposure
- timed is a LAN-oriented legacy service with no internet-facing use case; a public listener would be anomalous. [Likely]
- Notable CVE
- none identified for the timed protocol or daemon as of an August 2026 search. [Unknown]
- Malware association
- no credible source ties 525/tcp to a specific trojan, backdoor, or malware family as of an August 2026 search. [Unknown]
- Scanning activity
- no internet-wide scanning or contemporary threat-literature association found for 525/tcp as of an August 2026 search. [Unknown]
- IANA assignment
timed— "timeserver"; reference (blank); assignee (blank); dual-registered 525/tcp + 525/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry timed 525/tcp- Range class
- system/well-known (0–1023)
- Prevalence
- nmap-services open-frequency 525/tcp ≈ 0.000063 (~0.0063%); 525/udp ≈ 0.00089 (~0.089%) [Confirmed] — this site's own tooling
- Related ports
- 123/udp (NTP, its functional successor); other legacy time services
Primary use
legacy Unix timed/timedaemon LAN time-synchronization service using the Time Synchronization Protocol (TSP), a master/slave scheme in which the slave time daemons elect a new master when the current one disappears; predates NTP [Confirmed] — https://docs-archive.freebsd.org/44doc/smm/12.timed/paper.html, https://man.freebsd.org/cgi/man.cgi?query=timed&sektion=8, https://man.netbsd.org/NetBSD-9.3/timed.8
Other/unofficial uses
none credibly documented [Unknown]
Security implications
no CVE or malware association identified; service is largely obsolete and superseded by NTP, so an open instance is an anomaly worth investigating rather than an expected finding
Typically seen on
legacy/older Unix hosts still running timed; otherwise unexpected
- Analyst note
- An open port 525/tcp today most likely indicates a legacy Unix host or misconfiguration rather than a currently maintained service; verify against NTP (123) usage before assuming intent.
About port 525/udp.
Port 525/udp carries timed, the BSD Time Synchronization Protocol (TSP) daemon; it was designed for LAN-local clock sync among trusted Unix hosts and should stay internal-only rather than exposed to the public internet.
timed shipped with 4.3BSD Unix and implements a master/slave scheme: a host's timed asks a network master for the current time at startup, then applies periodic correction broadcasts from the master via adjtime(). Slaves also hold an election to pick a new master if the prior one disappears.
TSP was designed by Riccardo Gusella and Stefano Zatti and documented in a June 1985 UC Berkeley technical report rather than an IETF RFC, which matches the blank Reference field in the IANA registry for this assignment. Port 525 is dual-registered under the same timed/timeserver name on both tcp and udp; this entry covers 525/udp specifically.
timed predates NTP (port 123) and has been superseded by it on modern systems. Documented man pages for timed and its control utility timedc persist on BSD-lineage systems (FreeBSD, NetBSD), but no third-party or commercial application beyond the OS-bundled service was found using this port as of an August 2026 search — contemporary sightings are effectively legacy/documentation rather than live deployment.
- Exposure
- Internal-only — TSP was designed for LAN-local clock sync among trusted Unix hosts predating NTP, with no authentication model suited to internet exposure.
- Scanning caveat
- As a UDP port, 525 is subject to the general ambiguity of UDP scanning (a non-response can be read as "open"), which complicates remote assessment.
- Malware association
- none found in the sources reviewed (a check of a common trojan-port reference table did not list port 525) as of an August 2026 search; treat as an unconfirmed negative rather than a guarantee.
- IANA assignment
timed— "timeserver"; reference (blank — no RFC cited in IANA registry); assignee (none listed); dual-registered 525/tcp + 525/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry timed 525/udp- Range class
- system/well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry timed 525/udp
- Prevalence
- nmap-services open-frequency 525/udp ≈ 0.00089 (~0.089%); 525/tcp ≈ 0.000063 (de-facto) [Confirmed] — this site's own tooling (port 525, udp service entry)
- Related ports
- 525/tcp (same
timedassignment); 123/udp (NTP, the modern successor)
Primary use
BSD Time Synchronization Protocol (TSP) daemon — master/slave LAN clock sync, UC Berkeley tech report (Gusella & Zatti, June 1985), not an IETF RFC
Other/unofficial uses
none found beyond the BSD-shipped timed/timedc pair; superseded in practice by NTP (port 123)
Security implications
no CVE specific to timed/525 recorded in NVD as of August 2026; no malware/trojan association found in reviewed reference lists; UDP scanning of this port is ambiguous by nature
Typically seen on
legacy BSD/Unix hosts running timed; largely absent from modern deployments in favor of NTP
- Analyst note
- An open port 525 today is most plausibly a legacy BSD host or a decoy/anomaly, given how thoroughly
timedhas been superseded by NTP; investigate rather than assume legitimacy.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| timed | UDP | timeserver | 0.09% |
| timed | TCP | timeserver | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.