PORTUnauthenticated by defaultIANA assigned
Port 123NTP (Network Time Protocol)
Port 123 is the UDP port for NTP, the Network Time Protocol, which keeps computer clocks synchronised. Windows, macOS, Linux and network devices all query time servers on UDP 123. Accurate time is required for Kerberos authentication, TLS certificate checks and usable logs.
What port 123 is used for
An NTP client sends a small UDP packet to a time server on port 123 and receives one back; the timestamps in both let the client compute the network delay and the clock offset. Repeated over minutes and hours, the algorithm steers the local clock to within milliseconds of the reference.
Windows runs the Windows Time service. On a domain-joined machine it follows the domain hierarchy, ultimately the PDC emulator; standalone machines poll time.windows.com. Linux uses chrony or ntpd; macOS uses its own client. Routers, switches, cameras and hypervisors all need it too.
Why time matters
- Kerberos (Active Directory logon) rejects requests when clocks differ by more than the tolerance, five minutes by default.
- TLS certificate validation depends on the current date.
- Logs across systems can only be correlated if timestamps agree.
- Two-factor codes (TOTP) are derived from the current 30-second window.
Security considerations
- Open NTP servers are abused for amplification. The legacy
monlistcommand returned up to 600 addresses for a tiny query; attackers spoofed the source to flood victims. Modern servers disable it, but any NTP server reachable from the internet should restrict queries (restrictin ntpd,allowin chrony) and disable mode 7 commands. - Unauthenticated time can be manipulated. An attacker who can spoof NTP replies can shift a client's clock. Network Time Security (NTS) adds TLS-based authentication; Windows supports NTS from Windows 11 24H2 for the built-in client on supported servers.
- A workstation does not need an inbound 123 rule. The client sends the query and receives the reply on the same flow, which stateful firewalls handle automatically.
Checking NTP on Windows
w32tm /query /status
w32tm /stripchart /computer:time.windows.com /samples:3The first command shows the source, stratum and last sync; the second sends live NTP queries and prints the offset, which confirms UDP 123 is reachable.
Local listeners: netstat -ano -p udp | findstr :123 — on a workstation this is usually the Windows Time service itself, which binds the port to receive replies.
Firewall considerations
Only NTP servers (domain controllers, dedicated time servers) need inbound UDP 123. Allow outbound UDP 123 from everything, or point all devices at internal time servers and allow only those to reach the internet on 123.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 123 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Is NTP TCP or UDP?
UDP only. The protocol needs the lowest possible latency and does its own timestamping; TCP would add delay and jitter.
How do I force Windows to sync time?
In an elevated prompt: w32tm /resync. w32tm /query /status shows the current source and offset. Domain-joined machines sync from a domain controller; others default to time.windows.com.
Why does wrong time break HTTPS?
Certificates have validity periods. If the clock is years off, every certificate looks expired or not yet valid, and browsers refuse connections. Kerberos rejects tickets whose timestamps differ from the server by more than five minutes.