NTP

NTP (Network Time Protocol) synchronizes clocks across networked systems. It operates on UDP port 123. Nmap identifies the service as ntp and the ntp-info script extracts version and configuration details.

While NTP itself is not typically a direct entry point, it plays an important role in security assessments. Misconfigured NTP servers can be abused for DDoS amplification attacks using the monlist command, which returns a list of recent clients and can amplify traffic by a factor of hundreds. NTP servers also leak information about internal network topology, connected clients, and time sources.

Enumeration focuses on querying the server with ntpq and ntpdc to retrieve peer lists, server variables, and the monlist of recent clients. The ntp-monlist Nmap script automates this check. Manipulating time on a network can undermine Kerberos authentication (which depends on clock synchronization within 5 minutes), break certificate validation, and disrupt log correlation during incident response.