Core network servicesUDP 123 Cleartext by default
Port 123: NTP
Network Time Protocol
Synchronises clocks. Accurate time underpins logs, certificates and Kerberos.
How attackers abuse it
- Amplification DDoS through legacy monitoring commands on public servers.
- Spoofed time breaking authentication and log correlation.
How to defend it
- Use internal time sources with authenticated NTP or NTS.
- Disable legacy monitor queries; do not expose NTP publicly.
Exam tip
Without synchronised time you cannot reliably correlate events across systems in an investigation.