UDP port 123 is used by NTP, the time synchronization protocol.
A port is a transport layer number used together with an IP address and a protocol such as TCP or UDP to direct traffic to the correct service on a host.
A server process binds a socket to a port and listens, while a client typically chooses an ephemeral source port for outbound connections.
The combination of source and destination IP addresses, source and destination ports, and the transport protocol uniquely identifies a flow so the operating system can keep many conversations separate.
Firewalls, NAT, and scanners talk about ports because the destination port is the stable rendezvous point that exposes a service to the network.
NTP is typically UDP because the messages are small and periodic.
A client sends a request from an ephemeral source port to a server on destination port 123, and the server replies with timestamps that let the client estimate clock offset and network delay.
The client then adjusts its clock gradually and repeats the process, sometimes using multiple servers to improve accuracy and resilience.
Time is a security dependency: certificates, logs, Kerberos, and incident timelines all assume clocks are close to reality.
Exposed or misconfigured NTP can also be abused for reflection and amplification attacks, and attackers may try to shift time to break validation or confuse log analysis, which is why access controls and authenticated modes are relevant.