Port 22: SSH
Port 22 is SSH, and it is TCP. IANA also registers ssh on UDP and SCTP at port 22, but every real SSH implementation, including SFTP and SCP which run inside SSH, uses TCP.
| Port number | 22 |
|---|---|
| Service | Secure Shell / SFTP / SCP |
| Protocol | TCP |
| Category | Remote access |
| Default encryption | Yes (TLS/SSH) |
| IANA service name | ssh |
| IANA transports | TCP, UDP, SCTP |
| Used in practice | TCP |
Is SFTP the same as FTP on port 22?
No, and the name causes real confusion. SFTP is the SSH File Transfer Protocol, a subsystem that runs inside an existing SSH connection on port 22. It shares nothing with FTP beyond the goal of moving files.
FTPS is the other thing people mean: ordinary FTP with TLS bolted on, using ports 989 and 990 for implicit TLS or negotiating on port 21 for explicit TLS. If a client asks for a hostname, a port and a private key, you are doing SFTP. If it asks for a certificate and a passive port range, you are doing FTPS.
There is also a genuinely obsolete Simple File Transfer Protocol on port 115, which is unrelated to both. If a document mentions SFTP on port 115 it means that one.
Should you change SSH off port 22?
Moving SSH to a high port does not make it more secure in any cryptographic sense. Anyone who scans the full port range will find it, and a port scan of a single host takes seconds.
What it does do is cut the volume of automated login attempts hitting the service, which makes logs readable and reduces load. That is a real operational benefit, not a security control. The controls that matter are disabling password authentication in favour of keys, disabling direct root login, and putting the service behind a VPN or a bastion host if it does not need to face the internet.
Which ports are related to port 22?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 23 | plaintext | Telnet, the unencrypted remote login SSH replaced. Everything on port 23, passwords included, travels in clear text. |
| 21 | plaintext | FTP. SFTP runs inside SSH on port 22 and is unrelated to FTPS, which is FTP plus TLS on ports 989 and 990. |
| 2222 | alternate | A popular unofficial alternate SSH port chosen to cut log noise. IANA actually registers 2222 to EtherNet/IP. |
What commonly listens on port 22?
- OpenSSH sshd, the default on essentially every Linux and BSD system and on macOS
- Dropbear on embedded devices and routers
- Network device management planes on Cisco, Juniper and Arista hardware
- Git hosting: an ssh:// or git@ clone URL connects here
How do I check whether port 22 is open?
Port 22 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 22 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 22 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':22 ' | Lists the process bound to port 22 on Linux. On macOS use lsof -nP -iTCP:22 -sTCP:LISTEN, on Windows netstat -ano | findstr :22 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 22 TCP or UDP?
TCP. IANA registers the ssh service on TCP, UDP and SCTP at port 22, but SSH needs a reliable ordered byte stream, so every implementation uses TCP. If you are writing a firewall rule, allow TCP 22.
Does SFTP use port 22?
Yes. SFTP is a subsystem of SSH, so it runs inside a normal SSH connection on port 22 and needs no extra port opened. SCP does the same. FTPS is different: that is FTP with TLS, on ports 989 and 990.
What is port 22 used for?
Port 22 is SSH, and it is TCP. IANA also registers ssh on UDP and SCTP at port 22, but every real SSH implementation, including SFTP and SCP which run inside SSH, uses TCP.
Is port 22 secure?
Yes. Port 22 carries encrypted traffic by default, so data in transit is protected.
Should I open port 22 on my firewall?
Only if you specifically need SSH. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.