Port 123 · NTP

All network ports
Network services · Well-known123/udp

Port / UDP

123NTP

NTP keeps clocks aligned with reference time sources, which is what makes logs correlatable and certificates valid.

If it is internet-facing: Port 123 is legitimate in the right place, but exposed carelessly it widens the attack surface noticeably.

Exposure

Internet-facing

Transport

Cleartext

Risk if public

Elevated

Exposure verdict

ReachInternet-facing

Port 123 normally answers from the internet, but the transport is not confidential by default. Enforce the encrypted variant before the traffic leaves your network.

TransportCleartext

Traffic crosses the network readable and modifiable. Anything sensitive on this port needs a tunnel, a VPN, or a different protocol.

RangeWell-known (0–1023)

Assigned by IANA through a review process. On Unix systems a process needs root or the CAP_NET_BIND_SERVICE capability to bind here, which is why containers so often remap these to a higher port.

FamilyNetwork services

Grouped with the other network services ports so a rule written for one can be checked against its neighbours.

What actually goes wrong

2 notes
  • The legacy monlist command turned NTP servers into enormous amplification reflectors; disable mode 6 and 7 queries.
  • A host whose clock is pushed far enough out of true will reject valid certificates or accept expired ones.

Recommended firewall rule

Allow it, and harden the service

This port is expected to answer from anywhere, so the firewall is not where its security comes from.

ufw

sudo ufw allow 123/udp

iptables

sudo iptables -A INPUT -p udp --dport 123 -j ACCEPT

Check what is really there

Listening locally

sudo ss -ulpn 'sport = :123'

The bind address is the answer that matters: 127.0.0.1 is local-only, 0.0.0.0 and :: mean every interface.

Listening (macOS)

sudo lsof -nP -iUDP:123

macOS ships lsof rather than ss; this names the owning process and user.

From outside

nmap -sUV -Pn -p 123 <host>

A version probe confirms whether NTP is actually what answers, rather than trusting the number. Only scan hosts you are authorised to test.

Reachability

nc -vzu <host> 123

The quick yes/no when you only need to know whether a path exists through the firewall.

Nearby and related ports

8
ProtocolUDP
Rangewell-known
Transportcleartext
Exposurepublic