Port 22 SSH – Free, Online, Private

What listens on 22

Port 22 is where an SSH server accepts a TCP connection. The IANA name is ssh, described as The Secure Shell (SSH) Protocol, and the citation in the registry is RFC 4251. IANA also lists a UDP row. OpenSSH does not speak SSH over UDP. The TCP service is the one that matters. After the handshake the same channel carries interactive shells, exec requests, port forwards, and SFTP. The server's host key is how the client knows it reached the machine it asked for. Changing the Port directive in sshd_config moves the listener. It does not change the protocol.

The IANA service name is ssh: The Secure Shell (SSH) Protocol. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 22. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 22

Service notes for port 22: the IANA name is ssh (The Secure Shell (SSH) Protocol), and the program people mean is SSH. TCP 22 is the IANA ssh port. OpenSSH and every other SSH server use it for remote login and file transfer. Password authentication on a public 22 is scanned constantly. Prefer public keys, disable password login once keys work, and do not allow root login with a password. A non-default port reduces log noise and does not authenticate anyone. Fail2ban and firewall rate limits cut the noise further. An SSH server bound to a bastion, with the rest of the fleet reachable only through that bastion or through an identity-aware proxy, is a smaller attack surface than sshd on every instance. Agent forwarding and TCP forwarding are features. Turn them off where you do not need them, because a compromised session can use them. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 22, you are on the wrong page.

The outage after 'I moved SSH to another port' is a security group that still allows only 22, or a cloud-init script that rewrote sshd_config and failed, so the instance has no listener at all. Keep the console or a serial path. A second failure is sshd listening on 127.0.0.1 because of a ListenAddress line someone added and forgot. lsof will show it. nc from your laptop will time out or refuse, depending on whether anything else answers. A third is a host key change after a rebuild. Clients refuse the connection until known_hosts is updated. That refusal is the check working.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 22 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. For SSH, a listener on 127.0.0.1 is a local daemon, not a remote login. A listener on 0.0.0.0 or :: is reachable only if the firewall allows it. nc -vz from a second host is the test that matches what a user will experience.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• IANA lists UDP 22 as well. OpenSSH is TCP. A UDP probe does not test the server.
• Port 2222 is a common alternate and is not the IANA assignment. Test the port you configured, not the one you remember.
• A Docker publish of 22:22 on a container is a different network namespace from sshd on the host. ss on the host shows the docker-proxy, not sshd, when that is how you published it.
• IPv6 :: and IPv4 0.0.0.0 can be two sockets. Check both if the client is failing on only one.

Linuxsudo ss -lptn 'sport = :22'
sudo lsof -nP -iTCP:22 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:22 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.22[^0-9]'

Windowsnetstat -ano | findstr :22
Get-NetTCPConnection -LocalPort 22

Remotenc -vz host 22