Port 123 (NTP): Uses and Security

What uses port 123

Computers ask NTP servers for the current time over UDP port 123 and adjust their clocks gradually. Accurate time matters more than it seems: TLS certificate checks, Kerberos, TOTP two-factor codes, distributed databases and log correlation all break when clocks drift. Most systems sync automatically with chrony, ntpd or systemd-timesyncd.

Should port 123 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

Public NTP servers with the old monlist command enabled were abused for huge DDoS amplification attacks. Run a current NTP server and don’t answer queries from the whole internet unless you intend to.

Check what is listening on port 123

Linux

sudo ss -lunp 'sport = :123'

macOS

sudo lsof -nP -iUDP:123

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 123
netstat -ano | findstr :123

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Allow port 123 from trusted networks only

The examples allow 123 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 123 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 123 proto udp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="123" protocol="udp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "NTP 123/UDP" -Direction Inbound -Protocol UDP -LocalPort 123 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 123 from another machine

macOS / Linux

nc -zvu example.com 123   # UDP has no handshake, so "open" isn't conclusive

Related ports

Port 53 (DNS): used by DNS to translate domain names into IP addresses.
Port 88 (Kerberos): used by Kerberos authentication, including Active Directory logins.
Port 161 (SNMP): used by SNMP for monitoring and managing network devices.

More network services ports

67 (DHCP server) , 68 (DHCP client) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 389 (LDAP) , 636 (LDAPS) , 853 (DNS over TLS) . See all ports in the port lookup.

Sources

IANA port registry: 123

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 123 used for?

Port 123 is used by NTP, the Network Time Protocol, to keep clocks in sync. Computers ask NTP servers for the current time over UDP port 123 and adjust their clocks gradually. Accurate time matters more than it seems: TLS certificate checks, Kerberos, TOTP two-factor codes, distributed databases and log correlation all break when clocks drift. Most systems sync automatically with chrony, ntpd or systemd-timesyncd.

Is it safe to open port 123?

Only open this port to known networks or users, for example your office IP, a VPN or behind authentication. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 123 is open?

On the server, list listening sockets with "sudo ss -lunp 'sport = :123'" on Linux or "sudo lsof -nP -i :123" on macOS. From another machine, UDP has no handshake, so a port scan can’t reliably tell whether it is open; test with a real client for the service instead.