{
  "port": 123,
  "protocol": "udp",
  "service": "NTP",
  "oneLiner": "Network Time Protocol — clock synchronization, UDP 123.",
  "whatItIs": "NTP daemons (chrony, ntpd, ntpsec, systemd-timesyncd, Windows w32time) use UDP port 123 to exchange timestamps with upstream time servers. Clients normally only send queries, but a full server binds 123 and answers them. It shows up on a scan because a host is acting as a time server for its network, or because the daemon was left listening on all interfaces rather than just localhost. IANA lists ntp on both TCP and UDP 123, but real traffic is UDP.",
  "exposure": {
    "verdict": "careful",
    "note": "An open NTP server is a classic reflection/amplification source if monlist-style control queries or unrestricted mode 6/7 commands are reachable, so restrict it to the clients that need it."
  },
  "checkCommand": "sntp -t 5 time.cloudflare.com   # or: ntpdig -t 5 time.cloudflare.com",
  "links": [
    {
      "title": "RFC 5905 — Network Time Protocol Version 4",
      "url": "https://datatracker.ietf.org/doc/html/rfc5905",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "chrony (GitHub mirror)",
      "url": "https://github.com/mlichvar/chrony",
      "kind": "github"
    },
    {
      "title": "NTPsec (GitHub mirror)",
      "url": "https://github.com/ntpsec/ntpsec",
      "kind": "github"
    }
  ]
}