topic Re: ntp-tcp-Protocol-Signature Traffic in Firewall and Security Management

ntp-tcp-Protocol-Signature Traffic

Ihenock1011 — Sun, 17 Mar 2024 23:49:37 GMT

Hi All,

I have checkpoint r81.10 gateway and in my firewall log I get a lot of "ntp-tcp-Protocol-Signature Traffic" dropped traffic what is this service used for please help if it is a legit or not ?

Thanks

Re: ntp-tcp-Protocol-Signature Traffic

G_W_Albrecht — Mon, 18 Mar 2024 08:53:35 GMT

Who is sending this traffic ? NTP uses UDP, so the drop is understandable...

Re: ntp-tcp-Protocol-Signature Traffic

Ihenock1011 — Mon, 18 Mar 2024 12:56:57 GMT

Users which is allowed internet access

Re: ntp-tcp-Protocol-Signature Traffic

G_W_Albrecht — Mon, 18 Mar 2024 15:23:07 GMT

I would suggest to contact CP TAC to get an explanation!

Re: ntp-tcp-Protocol-Signature Traffic

PhoneBoy — Mon, 18 Mar 2024 16:19:50 GMT

NTP is used to synchronize clocks with a trusted time source, but it generally happens over UDP, not TCP.
A snapshot of the log card (with sensitive details redacted) would be helpful.

Re: ntp-tcp-Protocol-Signature Traffic

Ihenock1011 — Wed, 20 Mar 2024 07:33:53 GMT

Dear @PhoneBoy kindly find the screenshot

Re: ntp-tcp-Protocol-Signature Traffic

Lesley — Wed, 20 Mar 2024 09:10:29 GMT

Maybe a screenshot of 1 log entry?

Also maybe you made a custom application at one point that now is matching?

https://support.checkpoint.com/results/sk/sk103051

Re: ntp-tcp-Protocol-Signature Traffic

PhoneBoy — Wed, 20 Mar 2024 14:03:04 GMT

That's not a full log card, open up one of the log entries and send a screenshot (again with sensitive details redacted).