Hi Folks, I receive quite some, more than 200/sec, NTPv4 requestes on port 123 TCP, not UDP. I am not sure what to make of this, as it happens on all servers I operate. 107.18.37.188.rev.vodafone.pt.37830 > loadbalancer.kashra-server.com.123: Flags [S], seq 3725917667, win 65535, options [mss 141…

This is pretty normal for any host in the pool, although not necessarily at that volume. I just took a 1 MB sample of traffic, and for 8225 UDP port 123 packets, I received 5 TCP port 123 packets. It’s not NTP, but could be misconfigured daytime protocol, or just random port scans. Pings to a poo…

There are a lot of portscans going on to every port on every IP on the internet as well, this could be completely unrelated to the ntp pool

The incident rate of TCP 123 to other ports is about 5000 to 1, so portscans are most likely not the root cause for packets to TCP 123, even if they are a minor part the TCP 123 packets (about 1/5000) I investigated this a bit more and found that quite some of them are in fact ntpv4 client requests…

How can it be NTP? RFC5905 clearly specifies that NTP is UDP. Are there actually implementations out there which are so broken that they construct TCP queries and expect replies?

Yes, it seems there are clients that send valid NTPv3 requests over TCP and they receive data from the server. I have no idea why they do that, but I’d be interested to know if it’s a bug or feature.

Do note that NTP over TCP has been considered, although I don’t think this draft is directly related to this incident: https://tools.ietf.org/html/draft-stenn-ntp-tcp-services-00

There are two types of “TCP NTP clients” out there. #1 regular UDP NTP clients, where a company firewall-thingy translates UDP traffic to TCP for some unknown reason, but there are systems to do exactly that on the market. #2 Some awfully misconfigured routers which send TCP syn packets on port 12…

Can you give any examples of products which do #1 or references to seeing this traffic in the wild? I’m less curious about #2 because it seems likely to be a bug born of ignorance, but it would be good to know if you find out which makes & models do this.

Network time security is under study by IETF. Early NTS implementations temporarily used TCP port 123. TCP port 4460 has since been allocated for NTS.

NTP traffic on port 123 TCP (not UDP)

Server operators

paulgear July 8, 2020, 7:53am 11

But if it were NTS traffic, it would be TLS inside the TCP connection, not NTPv4, right?

Topic		Replies	Views
Buggy ntp server?	18	1832	April 3, 2020
My NTP server stopped responding to requests Server operators	7	712	July 26, 2021
Massive packet loss on be.pool.ntp.org since 9/09/2019 Client Configuration and Development monitoring	9	1486	September 14, 2019
Hourly server overload? Server operators	24	303	October 20, 2025
Howto deal with bad NTP-Client / Attacker? Server operators	50	2070	December 1, 2023

NTP traffic on port 123 TCP (not UDP)

Related topics