# NTP

> Time synchronization service

- **URL:** https://hackindex.io/services/ntp
- **Type:** Service
- **Default ports:** 123
- **Tags:** ntp, udp, network, time-sync, reconnaissance
- **Published:** 2025-12-31
- **Updated:** 2026-07-13

NTP (Network Time Protocol) synchronizes clocks across networked systems. It operates on **UDP port 123**. Nmap identifies the service as `ntp` and the `ntp-info` script extracts version and configuration details.

While NTP itself is not typically a direct entry point, it plays an important role in security assessments. Misconfigured NTP servers can be abused for DDoS amplification attacks using the `monlist` command, which returns a list of recent clients and can amplify traffic by a factor of hundreds. NTP servers also leak information about internal network topology, connected clients, and time sources.

Enumeration focuses on querying the server with `ntpq` and `ntpdc` to retrieve peer lists, server variables, and the monlist of recent clients. The `ntp-monlist` Nmap script automates this check. Manipulating time on a network can undermine Kerberos authentication (which depends on clock synchronization within 5 minutes), break certificate validation, and disrupt log correlation during incident response.

## Phases

- [Enumeration](https://hackindex.io/services/ntp/enumeration.md): Query NTP servers for version, peers, and misconfigs (1 guides)