# NTP Server Enumeration

- **URL:** https://hackindex.io/services/ntp/enumeration/ntp-server-enumeration
- **Path:** NTP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/ntp/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-01-04

NTP on UDP 123 often exposes version, peers, and stats on misconfigured servers. Responses leak internal IPs, upstream time sources, or enable reflection attacks. Positive info guides pivoting or time-based exploits.

## Nmap NTP Probes

Comprehensive discovery and vuln checks:

- Nmap NTP Probes
- Manual Peer and Association Listing
- Runtime and Clock Variables
- Clock Offset and Synchronization Check
- Legacy Monlist Query
- Basic Service Probe

```bash
nmap -sU -p 123 -sV --script "ntp* and (discovery or vuln)" $TARGET_IP
```

Version output identifies ntpd build; match against CVEs. Discovery scripts dump peers, system info, and variables.

Safe script subset avoids DoS:

```bash
nmap -sU -p 123 --script "ntp* and not (dos or brute)" $TARGET_IP
```

## Manual Peer and Association Listing

List remote peers:

```bash
ntpq -p $TARGET_IP
```

Columns show reachability, delay, offset, jitter. Internal IPs in remote column indicate private network leakage.

Detailed associations:

```bash
ntpq -c peers $TARGET_IP
```

Same data; use when -p format cluttered.

## Runtime and Clock Variables

Dump server variables:

```bash
ntpq -c rv $TARGET_IP
```

Reveals version string explicitly, system uptime, clock offset, leap indicator. Version field fingerprints daemon precisely.

Configuration variables:

```bash
ntpq -c readlist $TARGET_IP
```

Exposes restrict settings or mode 6 permissions on permissive servers.

Clock variables:

```bash
ntpq -c cv $TARGET_IP
```

Low-level details for advanced analysis.

## Clock Offset and Synchronization Check

Query without sync:

```bash
ntpdate -q $TARGET_IP
```

Reports server offset, stratum, root delay. High stratum or large offset flags poor config or potential manipulation vector.

Force sync test:

```bash
sudo ntpdate $TARGET_IP
```

Success confirms control query acceptance; affects local time for testing Kerberos skew.

## Legacy Monlist Query

Old amplification vector; still responds on vulnerable ntpd:

```bash
ntpdc -n -c monlist $TARGET_IP
```

Dumps recent clients; massive output on busy servers confirms reflection potential.

## Basic Service Probe

Raw UDP poke:

```bash
echo "" | nc -u -w1 $TARGET_IP 123
```

Any response confirms listening NTP daemon. Timeout suggests filtered or closed.

## References

- [RFC 5905: Network Time Protocol Version 4](https://datatracker.ietf.org/doc/html/rfc5905) - NTPv4 protocol specification and mode definitions
- [Nmap: ntp-info](https://nmap.org/nsedoc/scripts/ntp-info.html) - Nmap NSE script for NTP version and variable extraction