5222

Port 5222/tcp is registered with IANA as xmpp-client with the description "XMPP Client Connection" and reference [RFC6120]; the assignee, contact, and registration/modification date fields are blank in the registry. It carries the client-to-server (C2S) leg of XMPP, the Extensible Messaging and Presence Protocol — an XML-based open standard for near-real-time messaging and presence that grew out of the Jabber project (started by Jeremie Miller in 1998; jabberd released January 1999) and was standardized by the IETF as RFC 3920/3921 in October 2004, with the current core specs RFC 6120 (client streams) and RFC 6121 (IM and presence) published in 2011. A client opens a plaintext TCP stream on 5222, issues STARTTLS to upgrade the connection to TLS, then authenticates over SASL; modern servers commonly require TLS, and end-to-end encryption is available through the OMEMO extension (XEP-0384), which keeps the relaying server from reading message bodies. The companion server-to-server federation path runs separately on 5269/tcp (xmpp-server), so an analyst seeing 5222 specifically is looking at client logins rather than inter-domain traffic. Common server software includes ejabberd, Prosody, Openfire, and jabberd; clients span Conversations, Gajim, Dino, Monal, Pidgin, and Psi, and the protocol historically backed Google Talk (retired 2015), Facebook Chat (dropped XMPP in 2014), and Cisco Jabber/IM&P, with WhatsApp running a closed XMPP-derived protocol. For an analyst, port 5222 is a well-known, routinely scanned service port (Shodan/Censys index it; Nmap ships the xmpp-info NSE fingerprinting script). The risk profile is dominated by server-implementation flaws rather than protocol design: credential brute-forcing, STARTTLS-stripping downgrade/MITM when TLS is not enforced, and denial-of-service via crafted XML streams. Documented CVEs are server bugs — CVE-2017-17750 and CVE-2017-17751 (ejabberd stream-handling DoS) and CVE-2016-7543 (Prosody before 0.9.13/0.10.1 CPU-exhaustion DoS) — with no critical RCE specific to the port surfaced in the reviewed sources. Standard mitigations are enforced TLS, strong SASL mechanisms, rate-limiting, and keeping ejabberd/Prosody patched.

IANA assignment

xmpp-client — "XMPP Client Connection"; reference [RFC6120]; assignee/contact/dates blank in registry [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Prevalence/exposure

well-known port routinely included in internet-wide scans (Shodan, Censys); Nmap xmpp-info NSE fingerprints servers on 5222; no specific dated census count located [Likely] — Nmap NSE library; Shodan port index

Primary use

XMPP client-to-server (C2S) connection; client opens a TCP stream, STARTTLS to TLS, SASL auth

Protocol history

Jabber started 1998 (Jeremie Miller), jabberd Jan 1999; IETF RFC 3920/3921 (Oct 2004); core RFC 6120/6121 (2011); JID format RFC 7622 (2015)

Common software

servers ejabberd, Prosody, Openfire, jabberd; clients Conversations, Gajim, Dino, Monal, Pidgin, Psi; historical Google Talk (to 2015), Facebook Chat (XMPP dropped 2014), Cisco Jabber/IM&P; WhatsApp uses a closed XMPP-derived protocol

UDP status

5222/udp is Reserved with no service name assigned — not a dual registration [Confirmed] — IANA registry CSV

Companion port

5269/tcp (xmpp-server) carries server-to-server federation; 5222 is client-only [Confirmed] — Wikipedia: XMPP

Encryption/auth

STARTTLS upgrade on 5222, SASL authentication; OMEMO (XEP-0384) provides E2E encryption [Confirmed] — RFC 6120; XMPP/OMEMO

Known CVEs

CVE-2017-17751 and CVE-2017-17750 (ejabberd crafted-stream DoS); CVE-2016-7543 (Prosody <0.9.13/0.10.1 CPU-exhaustion DoS) — all server-implementation bugs, no port-specific critical RCE found [Confirmed] — NVD (via ScaniteX aggregation)

Attack surface

credential brute-force; STARTTLS-strip MITM when TLS not enforced; DoS via malformed XML streams; XXE/XSS and info disclosure in unpatched servers [Confirmed] — ScaniteX/ScanSearch port 5222 analyses

Analyst note

An open 5222 is a normal, well-known XMPP client port — assess whether TLS is enforced and the server (ejabberd/Prosody/Openfire) is patched; check 5269 separately for federation.

Port 5222/udp is listed as Reserved in the IANA Service Name and Transport Protocol Port Number Registry: the UDP row carries no service name, no description text beyond "Reserved," no assignee, and a blank reference field — all reproduced here as-is rather than treated as omissions. This stands in deliberate contrast to its TCP counterpart, 5222/tcp, which IANA registers as xmpp-client ("XMPP Client Connection") under RFC 6120, the core specification of the Extensible Messaging and Presence Protocol. XMPP is a client-to-server messaging protocol built on long-lived, ordered XML streams, and in practice it runs exclusively over TCP; UDP is architecturally unsuitable because XMPP depends on reliable, in-order delivery of an XML stream, and no XMPP extension (XEP) defines a UDP or DTLS transport bound to 5222. As a result, no software legitimately listens on 5222/udp by design. For an analyst, the practical meaning is that real-world activity on the 5222 number — XMPP servers such as ejabberd, Prosody, and Openfire; historical Google Talk; Cisco Jabber; and even QuakeLive game connections noted by SANS ISC — all occur over TCP. Internet scanning of 5222 likewise targets TCP, looking for exposed XMPP servers, with documented abuse patterns including XMPP credential brute-forcing, malware command-and-control over XMPP (the JabberZeus banking trojan historically used XMPP on 5222), and exploitation of unpatched Openfire servers (multiple CVEs). No distinct scanning campaign or threat actor is documented for the UDP variant specifically: any UDP traffic reaching 5222 is most plausibly unsolicited noise or misrouted probes rather than protocol-aware exploitation, since nothing answers on 5222/udp.

IANA assignment

Reserved — no service name, no assignee, blank reference field on the 5222/udp row [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV line 9555)

Range class

registered (1024–49151)

Primary use (UDP)

none — Reserved, not actively assigned; XMPP runs only over TCP; no XEP defines a UDP/DTLS transport on 5222

Common software on the 5222 number (TCP only)

ejabberd, Prosody, Openfire (Jabber/XMPP servers), historical Google Talk, Cisco Jabber, QuakeLive game connections

Exposure & scanning

Internet scanning of 5222 targets TCP, seeking exposed XMPP servers; SANS ISC shows a low (green) threat level; no UDP-specific scanning campaign documented — UDP hits read as noise/misrouted probes

Security implications (TCP 5222)

XMPP credential brute-force, malware C2 over XMPP (JabberZeus historically), unpatched-Openfire exploitation

TCP counterpart

5222/tcp = xmpp-client — "XMPP Client Connection" (RFC 6120) [Confirmed] — IANA registry (CSV line 9554), RFC 6120

Security recommendation

bind nothing to 5222/udp and block inbound UDP at the perimeter; for 5222/tcp require STARTTLS or Direct TLS (XEP-0368 / 5223), enforce strong auth, keep XMPP software patched, expose only if running a public XMPP service [Likely] — XEP-0368, scanitex

Analyst note

5222/udp is Reserved with no legitimate listener; treat UDP activity on 5222 as noise/misrouted traffic, and route any real XMPP investigation to 5222/tcp.