Common attacks and weaknesses
- monlist amplification DDoS on old servers.
- Time spoofing affecting certificates and Kerberos.
Port 123: NTP
Time synchronization.
123
How NTP works
Network servicesThe client sends a request to port 123 and the NTP service answers. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP
- Exposure risk
- 5/10 moderate if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Network services
Is port 123 dangerous?
How to secure it
- Disable monlist (noquery) and restrict queries.
- Use NTS where supported.
IANA registry entries for port 123
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ntp | 123 | TCP, UDP | Network Time Protocol | RFC 5905 | - |
// source: IANA service name and port number registry
Which program uses port 123, and is it reachable?
Linux
sudo ss -ltnup 'sport = :123' # process listening on 123
sudo lsof -nP -i :123macOS
sudo lsof -nP -i :123
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 123 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 123 netstat -ano | findstr :123
From another machine
nmap -p 123 -sV <host> sudo nmap -sU -p 123 <host> nc -zv <host> 123
Block it in the firewall
sudo ufw deny 123/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 123" -Direction Inbound -LocalPort 123 -Protocol TCP -Action Block # Windows
What is port 123 used for?
Time synchronization.
Is port 123 TCP or UDP?
Port 123 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 123?
It is rated 5/10 (moderate) when exposed to the Internet. monlist amplification DDoS on old servers. Disable monlist (noquery) and restrict queries.
How do I check if port 123 is open?
On Linux run "ss -ltnup 'sport = :123'", on macOS "lsof -nP -i :123", and on Windows "netstat -ano | findstr :123" to see the local process. From another machine, "nmap -p 123 <host>" shows whether it is reachable.
Other network services ports
:53 DNS tcp · udp · moderate risk :135 MS RPC tcp · udp · high risk :67 DHCP server udp · tcp · moderate risk :111 rpcbind tcp · udp · high risk :9100 Raw printing (JetDirect) tcp · udp · high risk :631 IPP / CUPS tcp · udp · high risk :5353 mDNS udp · tcp · moderate risk :5355 LLMNR udp · tcp · high risk