Port 13 – DAYTIME (Daytime Protocol)

Port 13 is the default port for the Daytime Protocol (RFC 867), a legacy diagnostic service that returns the host’s current date and time as a human-readable ASCII string over both TCP and UDP. It was built so one machine could read another’s clock or sanity-check a connection, long before NTP existed. Modern systems have no reason to run it, so an open port 13 is almost always a leftover “small service” — an information-disclosure and UDP packet-storm risk with no operational upside.

Why It’s Open

Daytime is one of the original “small services” (echo 7, discard 9, daytime 13, chargen 19) that shipped enabled in inetd/xinetd on UNIX and in Simple TCP/IP Services on older Windows. You’ll usually find it still listening on legacy servers, network appliances, printers, and embedded/IoT gear where nobody trimmed the default service set. It’s the direct sibling of Echo on port 7 — when one small service is open the rest usually are too, so scan for the whole cluster.

Common Risks

• System clock disclosure. Anyone can read the exact host time and date format with no authentication. Clock skew is a handy recon signal: it hints at the OS, patch cadence, and whether time-sensitive protocols like Kerberos will behave.
• UDP reflection & packet storm. UDP daytime answers a spoofed source address, so it can be bounced at another host — or looped into another small service — to create the classic UDP “packet storm” denial of service (CVE-1999-0103).
• OS fingerprinting. The date string format differs between BSD, System V, and Windows implementations, so a single reply narrows down the platform.
• Attack surface with no upside. No auth, no encryption, no modern purpose — every open instance is pure risk that scanners will flag in your report.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service (TCP and UDP)

nmap -sV -p 13 <target>
nmap -sU -sV -p 13 <target>

Read the time over TCP

nc <target> 13

The server sends a date string such as Wed Jul 15 12:34:56 2026 and immediately closes the connection.

Query over UDP

echo "" | nc -u -w1 <target> 13

An empty datagram is enough to trigger the reply — that same spoofable behavior is what makes UDP daytime a reflector.

Run the Nmap daytime script

nmap -sU -sV -p 13 --script daytime <target>

Check the rest of the small-services cluster

nmap -sU -sV -p 7,9,13,19 <target>

Record every exposed instance you confirm so it lands in the final pentest report.

What to Look For

Known CVEs and Exploits

• CVE-1999-0103 — Echo, chargen, and other combinations of UDP services (daytime among them) can be pointed at each other to flood a host: the “UDP bomb” / packet storm. This is the specific weakness behind an exposed UDP daytime service.
• Scanner “daytime service running” finding — Nessus and Nmap flag an open daytime port as an unnecessary exposed service that should be disabled. It’s informational rather than a code-execution bug, but it’s what shows up in vulnerability reports and hardening baselines.
• Poor amplifier, usable reflector — daytime’s reply is a fixed ~26-byte string, so it won’t amplify traffic the way chargen or NTP do. Its value to an attacker is as a reflection/packet-storm source, not a bandwidth multiplier — worth stating accurately so the finding is triaged correctly.

Mitigation

• Disable the daytime service. In xinetd, set disable = yes for daytime on both TCP and UDP and restart; on Windows, remove the “Simple TCP/IP Services” feature.
• Kill the whole small-services bundle. While you’re in there, turn off echo (7), discard (9), and chargen (19) too.
• Use NTP for real time sync. If something actually needs the clock, run NTP on port 123 instead of exposing daytime.
• Firewall TCP/UDP 13 at the perimeter. On Cisco IOS, no service udp-small-servers and no service tcp-small-servers disable the diagnostic ports outright.
• Block spoofed traffic with BCP 38 / uRPF ingress filtering so your hosts can’t be abused as reflectors.
• Rescan after remediation to confirm both the TCP and UDP listeners are gone.

Real-World Example

CERT Advisory CA-96.01 (“UDP Port Denial-of-Service Attack”, February 1996) is the reason daytime is disabled by default today. Attackers were forging UDP packets to wire one host’s diagnostic service to another’s, creating a self-sustaining packet storm that consumed all bandwidth between them. The advisory told administrators to comment out daytime alongside echo, discard, chargen, and qotd — daytime was named explicitly. Three decades on, that guidance is still standard hardening, which is why finding port 13 open usually means a device was never brought up to a modern baseline.

FAQ

What service runs on port 13?

The Daytime Protocol (RFC 867), a legacy diagnostic service that returns the host’s current date and time as a human-readable string over TCP and UDP. It’s one of the old “small services” alongside echo (7), discard (9), and chargen (19).

Is port 13 dangerous?

Daytime has no remote code-execution bugs, but an open UDP port 13 is a genuine risk: it discloses the system clock and OS fingerprint without authentication and can be abused as a reflector in a UDP packet-storm DoS (CVE-1999-0103). Since the service has no modern use, closing it is the safe call.

How do I close port 13?

Disable daytime in your inetd/xinetd config (disable = yes for both TCP and UDP) or remove Windows Simple TCP/IP Services. On Cisco IOS use no service udp-small-servers and no service tcp-small-servers, then firewall port 13 and rescan to confirm both listeners are gone.

TL;DR

• Service: Daytime Protocol (RFC 867), a date/time diagnostic service
• Default port: 13/TCP and 13/UDP
• Biggest risk: system-clock/OS disclosure and UDP reflection packet-storm DoS (CVE-1999-0103)
• Mitigation: disable daytime, drop the small-services bundle, use NTP, and firewall port 13