NTP

The NTP probe sends standard client time requests (mode 3) and parses key header fields from responses.

rmap scan --path ntp-servers.txt ntp --port 123 \
  --output-file ntp.csv --columns target,port,ntp_stratum,ntp_reference_id,alias

Configuration

• --port <u16> – destination port (default 123).

Tags emitted

• ntp_stratum – stratum reported by the server.
• ntp_reference_id – 32-bit reference identifier (hex string).
• port – responder port.
• alias / alias_prefix – dealiaser verdict.

The probe uses an empty payload aside from the standard NTP header; it does not attempt monlist amplification.