Encrypted remote shell, file transfer (SFTP, SCP) and port forwarding. Constantly scanned and brute-forced on the Internet.
The client opens a session to port 22: each command typed is sent to the server, which runs it and returns the output. Everything is encrypted: someone on the path only sees unreadable bytes.
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| ssh | 22 | TCP, UDP, SCTP | The Secure Shell (SSH) Protocol | RFC 4251 | - |
// source: IANA service name and port number registry
Linux
sudo ss -ltnup 'sport = :22' # process listening on 22
sudo lsof -nP -i :22macOS
sudo lsof -nP -i :22
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 22 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 22 netstat -ano | findstr :22
From another machine
nmap -p 22 -sV <host> sudo nmap -sU -p 22 <host> nc -zv <host> 22
Block it in the firewall
sudo ufw deny 22/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 22" -Direction Inbound -LocalPort 22 -Protocol TCP -Action Block # Windows
Encrypted remote shell, file transfer (SFTP, SCP) and port forwarding. Constantly scanned and brute-forced on the Internet.
Port 22 is registered for TCP and UDP and SCTP. In practice the service mostly uses TCP.
It is rated 5/10 (moderate) when exposed to the Internet. Password brute force and credential stuffing from botnets, around the clock. Disable password login and root login; use keys or certificates.
On Linux run "ss -ltnup 'sport = :22'", on macOS "lsof -nP -i :22", and on Windows "netstat -ano | findstr :22" to see the local process. From another machine, "nmap -p 22 <host>" shows whether it is reachable.