Port 123 (NTP)
Network Time Protocol clock synchronisation.
- Transport
- UDP
- Internet exposure
- Restrict
Expose only to specific networks, or behind a VPN.
Security notes
- Older NTP servers that answer the monlist command were widely abused for amplification DDoS.
- Accurate time matters for security: log correlation and Kerberos both depend on it.
When it shows up in your logs
Large NTP responses leaving your network suggest your server is being used for amplification.