22
Summary
- // if you see it open
- Internet-exposed SSH faces continuous automated brute-force and credential-stuffing. Risks: weak/default passwords, leaked private keys, obsolete SSH-1 (CVE-2001-0144). Mitigations: key-based auth, disable root login and password auth, fail2ban/lockout, MFA. Port relocation reduces noise, not risk.
- // common applications
- OpenSSHDropbearPuTTYWinSCPlibssh
- // analyst note
- An open 22/tcp almost always means a live SSH daemon for remote admin. Fingerprint the SSH software/version, determine whether password auth is enabled, and review auth logs for brute-force patterns and anomalous successful logins.
About port 22/tcp.
Port 22/tcp is the IANA-assigned home of SSH, the Secure Shell protocol, and is one of the most consistently open and most heavily attacked TCP ports on the public internet. SSH is the default channel for administering Linux/Unix servers, cloud instances, routers, switches, and embedded devices — providing encrypted remote login, command execution, file transfer (SCP/SFTP), and tunneling/port-forwarding. The protocol is layered: a transport layer (RFC 4253) that handles server authentication, key exchange, encryption, and integrity; a user-authentication layer (RFC 4252); and a connection layer (RFC 4254) that multiplexes channels over the single TCP session. An internet-exposed SSH daemon faces continuous automated brute-force and credential-stuffing; honeypot research routinely records millions of login attempts against a single sensor. The practical analyst takeaway is that an open 22/tcp almost always means a live SSH service for remote administration — the questions that matter in triage are which SSH implementation and version is running, whether password authentication is enabled (versus key-only), and whether auth logs show brute-force patterns or successful logins from anomalous sources. Relocating SSH to a non-standard port (2222, 22222) reduces log noise but is not a security control, since scanners enumerate any open port.
- IANA assignment
ssh— "The Secure Shell (SSH) Protocol"; reference [RFC4251] [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.182286 (one of the most common open TCP ports, typically top ~5) [Well-established] — nmap-services file (nmap.org/book/nmap-services.html)
- Related ports
- 23/tcp Telnet (insecure predecessor SSH replaced); 2222 (common alternate SSH)
Primary use
encrypted remote login, command execution, file transfer (SCP/SFTP), and secure tunneling/port forwarding
Other/unofficial uses
SFTP/SCP, Git-over-SSH, SSH tunneling/SOCKS proxy; frequently relocated to 2222/22222
Security implications
continuous brute-force/credential-stuffing against exposed daemons; risks from weak/default passwords, leaked private keys, obsolete SSH-1 (e.g., CVE-2001-0144). Mitigate with key-based auth, disabling root login + password auth, fail2ban/lockout, and MFA. Port relocation reduces noise, not risk
Typically seen on
Linux/Unix servers, cloud instances, routers/switches, developer machines, IoT/embedded devices
- Analyst note
- An open 22/tcp almost always means a live SSH daemon for remote admin. Fingerprint the SSH software/version, determine whether password auth is enabled, and review auth logs for brute-force patterns and anomalous successful logins.
About port 22/udp.
Port 22/udp is registered with IANA as ssh with the description "The Secure Shell (SSH) Protocol," reference [RFC4251], and blank assignee/contact/registration-date fields. It is a dual registration: the well-known number 22 is reserved for the same service name and description on both tcp and udp, a legacy artifact of IANA's historical policy of reserving a port on both transports at once. The substance of port 22 belongs to 22/tcp — SSH is a TCP-only protocol by design, requiring reliable, ordered, connection-oriented delivery for its key exchange, encrypted session, and channel multiplexing — so the udp slot is nominally reserved but functionally unused by every standard deployment (OpenSSH, Bitvise, and the rest listen on tcp only). The IANA row also carries the assignment note "Defined TXT keys: u=<username> p=<password>." An expired experimental IETF draft (draft-bider-ssh-quic-04, 2020) proposed running SSH over QUIC, a UDP-based transport, but flagged itself as early-stage work-in-progress, did not mandate port 22/udp, and never advanced to RFC status. For an analyst the practical consequence is that no production service listens on 22/udp: internet-wide UDP scans of this port yield essentially no responsive hosts, and a host that does answer on 22/udp is anomalous and worth investigating rather than a normal service. The exposure and threat story — continuous automated brute-force and credential-stuffing against millions of internet-facing OpenSSH hosts indexed by Shodan — is entirely a 22/tcp phenomenon; 22/udp does not share that threat profile and is not treated as a meaningful attack surface in current threat intelligence. A separate sctp registration for port 22 also exists (assignee Randall Stewart, reference [RFC9260]) but is out of scope for this udp entry.
- IANA assignment
ssh— "The Secure Shell (SSH) Protocol"; reference[RFC4251]; assignee/contact blank; dual-registered 22/tcp + 22/udp; assignment note "Defined TXT keys: u=<username> p=<password>" [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — IANA registry
- Prevalence / exposure
- no production service listens on 22/udp; internet-wide UDP scans yield essentially no responsive hosts. The exposure story for port 22 belongs to 22/tcp (millions of internet-facing OpenSSH hosts indexed by Shodan) [Likely] — Nmap UDP scan documentation, SecureBin open-ports overview
- Registration date
- Unknown — IANA does not publish registration dates for well-known port assignments; third-party "date registered" values are database artifacts with no authoritative source [Unknown]
- Related ports
- 22/tcp (the substantive SSH registration); 22/sctp (assignee Randall Stewart, [RFC9260], out of scope here)
Primary use
nominally reserved for SSH; SSH is TCP-only by design (reliable, ordered, connection-oriented), so 22/udp is functionally unused by every standard deployment
Other/unofficial uses
an expired experimental draft (draft-bider-ssh-quic-04, 2020) proposed SSH over QUIC (UDP transport) but did not mandate 22/udp and never reached RFC status
Common software on 22/udp
none known in production; OpenSSH and other implementations listen on tcp only
Security implications
22/udp sees negligible real-world traffic and no documented active exploitation as a distinct vector; a responsive 22/udp host is anomalous. The high-exposure brute-force/credential-stuffing threat profile is a 22/tcp phenomenon, not udp
- Analyst note
- A responsive port 22/udp is anomalous and worth investigating as a non-standard or rogue service; legitimate use is essentially nonexistent. Pivot analysis of "SSH on port 22" to the tcp entry.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ssh | TCP | Secure Shell Login | 18.23% |
| ssh | UDP | Secure Shell Login | 0.39% |
| ssh | SCTP | Secure Shell Login | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.