Network scans could be associated with Network Time Protocol

A number of complaints have been opened concerning scans on UDP port 123. Investigation often indicates that these scans are associated with activity performed by Network Time Servers (NTP). The function of these servers is to provide single source for synchronizing the internal clock of computer systems.

Under some conditions, an intrusion detection (firewall) package might interpret this activity as an unauthorized attempt to access your computer system. There are a number of NTP servers on the University campus.

These servers include:

If you experience a scan from one of these systems and you are using both an NTP client application and some type of intrusion detection software, the condition might not be an unauthorized access attempt. Please see the information and web URLs below for additional information about NTP.

To find out more about NTP, you can visit http://www.ntp.org/

Additionally, there is a suite of tools distributed on the Internet that contains an NTP client. At one time, the default NTP server pointed to a host at Texas A&M University. The suite of tools could be retrieved from http://bigben.standord.edu/LabSuiteFrame.htm