Network Time Protocol — clock synchronization, UDP 123.
NTP daemons (chrony, ntpd, ntpsec, systemd-timesyncd, Windows w32time) use UDP port 123 to exchange timestamps with upstream time servers. Clients normally only send queries, but a full server binds 123 and answers them. It shows up on a scan because a host is acting as a time server for its network, or because the daemon was left listening on all interfaces rather than just localhost. IANA lists ntp on both TCP and UDP 123, but real traffic is UDP.
Expose with care
An open NTP server is a classic reflection/amplification source if monlist-style control queries or unrestricted mode 6/7 commands are reachable, so restrict it to the clients that need it.
$ sntp -t 5 time.cloudflare.com # or: ntpdig -t 5 time.cloudflare.com
Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.