992

Port 992/tcp is Telnet wrapped in implicit TLS/SSL — the secure analogue of plaintext Telnet on port 23, which transmits usernames, passwords, and session data in cleartext. On 992 the TLS handshake is negotiated on connect and the Telnet session then runs inside the encrypted tunnel, providing the confidentiality and integrity that Telnet itself lacks while preserving Telnet's Network Virtual Terminal model and option negotiation. In practice it is rarely used: SSH (port 22) became the dominant secure remote-terminal protocol long ago, offering encryption, strong authentication, port forwarding, and file transfer in one well-supported package, so secure-Telnet endpoints are uncommon outside some legacy or embedded environments. The IANA registry lists telnets with a blank reference field (and a blank assignee), so there is no IANA-cited RFC for the assignment. Security-wise, even with TLS the underlying protocol is a legacy interactive-terminal service, and an open 992 is unusual enough that it is worth flagging during triage and confirming why Telnet (rather than SSH) is in use; the TLS layer is only as good as its certificate and negotiated cipher suite. For an analyst, an open 992/tcp indicates a TLS-wrapped Telnet endpoint — validate the certificate and TLS version, and treat the presence of any Telnet-family service as a prompt to migrate to SSH.

IANA assignment

telnets — "telnet protocol over TLS/SSL"; reference (blank — no RFC cited in IANA registry); assignee/contact blank [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

rare (SSH dominates secure remote terminal access; de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

23 (plaintext Telnet); 22 (SSH, the modern secure replacement); 2323 (alternate Telnet)

Primary use

Telnet over implicit TLS — encrypted remote terminal, the secure analogue of port 23

Other/unofficial uses

none notable beyond secure Telnet [n/a]

Security implications

even with TLS, Telnet is legacy; an open 992 is unusual; TLS protection is only as good as the cert/cipher; SSH (22) preferred

Typically seen on

legacy or embedded systems offering secure Telnet; uncommon on modern hosts

Analyst note

Open 992/tcp indicates a TLS-wrapped Telnet endpoint. Validate the certificate and TLS version, and treat any Telnet-family service as a prompt to migrate to SSH.