Port 22: SSH
TCP 22 is the port for Secure Shell (SSH, SFTP, SCP). Commonly exposed, but it is scanned constantly. Use key-only authentication, disable root login, and restrict source IPs or put it behind a VPN where you can.
| Service | Secure Shell (SSH, SFTP, SCP) |
|---|---|
| Protocol | TCP |
| Exposure risk | Medium: expose with care |
| Range | Well-known (0–1023): binding needs root/admin on Unix |
What port 22 does
SSH gives encrypted remote shell access and also carries SFTP and SCP file transfers, Git over SSH, and port-forwarding tunnels. It is the standard way to administer Linux and network devices.
Should port 22 be open?
Commonly exposed, but it is scanned constantly. Use key-only authentication, disable root login, and restrict source IPs or put it behind a VPN where you can.
Find what's listening on port 22
- Linux:
sudo ss -tulpn | grep :22 - macOS:
sudo lsof -nP -i :22 - Windows:
netstat -ano | findstr :22, then look up the PID in Task Manager.
Open or block it in a firewall
- ufw:
sudo ufw allow 22/tcp(ordeny) - firewalld:
sudo firewall-cmd --add-port=22/tcp --permanent && sudo firewall-cmd --reload - Windows:
New-NetFirewallRule -DisplayName "Port 22" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow
Port assignment per the IANA Service Name and Transport Protocol Port Number Registry. Test several ports at once with the port scanner, or any port with the open port checker.
Questions about port 22
What is port 22 used for?
Secure Shell (SSH, SFTP, SCP). SSH gives encrypted remote shell access and also carries SFTP and SCP file transfers, Git over SSH, and port-forwarding tunnels. It is the standard way to administer Linux and network devices.
Is port 22 TCP or UDP?
TCP. SSH uses TCP port 22.
Is it safe to open port 22?
Medium: expose with care. Commonly exposed, but it is scanned constantly. Use key-only authentication, disable root login, and restrict source IPs or put it behind a VPN where you can.
How do I check if port 22 is open?
Use the checker on this page: it connects to your host on TCP 22 from the internet. Locally, run
nc -vz host 22 (macOS/Linux) or Test-NetConnection host -Port 22 (PowerShell). To see what is listening on your own machine, run ss -tulpn | grep :22 (Linux) or netstat -ano | findstr :22 (Windows).