Understanding TCP Port 23 and Why You Must Secure Telnet Services

TCP port 23 is the default network port assigned by the Internet Assigned Numbers Authority (IANA) for the Telnet protocol. Telnet, short for Terminal Network, is a legacy protocol used to provide a bidirectional, interactive text-oriented communication facility using a virtual terminal connection.

In the modern cybersecurity landscape, port 23 is synonymous with unencrypted communication. While it was once the standard for remote server administration, it has been largely superseded by Secure Shell (SSH) on port 22 due to significant security vulnerabilities. Understanding how port 23 operates, why it poses a threat, and how to manage its status is essential for network administrators and security professionals alike.

Technical Fundamentals of TCP Port 23

To understand port 23, one must understand its relationship with the Transmission Control Protocol (TCP). Unlike UDP (User Datagram Protocol), which is connectionless and best-effort, TCP is connection-oriented. This means that before any Telnet data is exchanged, a formal connection—the "three-way handshake"—must occur between the client and the server.

The Connection Process

When a user initiates a Telnet session, the client software sends a SYN (Synchronize) packet to the server's IP address on port 23. If the server is listening and accepts the connection, it responds with a SYN-ACK (Synchronize-Acknowledgment). Finally, the client sends an ACK (Acknowledgment), establishing the session.

Once connected, the Telnet protocol operates at the Application Layer (Layer 7) of the OSI model. It uses the Network Virtual Terminal (NVT) character set, which allows different types of computers and terminals to communicate without worrying about their internal architectures.

Protocol Negotiation

One unique feature of the service running on port 23 is "option negotiation." Telnet clients and servers use specific commands (WILL, WONT, DO, DONT) to agree on session parameters, such as terminal type, line width, and echoing characters. This negotiation happens over the established TCP stream but remains entirely in plaintext.

The Historical Context of Port 23

In the 1970s and 1980s, during the early development of the ARPANET and the subsequent birth of the Internet, port 23 was the gateway to the world’s computing power. Researchers used Telnet to log into remote mainframes and Unix systems from thin clients. At that time, the network was a closed community of trusted academic and military institutions. Security, specifically encryption, was not a primary design requirement because the physical lines were considered relatively secure and the users were few.

As the internet transitioned into a public utility in the 1990s, the design flaws of port 23 became apparent. Hackers began using packet sniffers to capture data moving across the wire, realizing that everything—including administrative passwords—was visible.

Critical Security Risks Associated with Port 23

The consensus among security experts is clear: port 23 should not be exposed to the public internet, and its use on internal networks should be strictly minimized. The risks are not theoretical; they are fundamental to the protocol's design.

1. Plaintext Vulnerability

The most glaring issue with port 23 is the lack of encryption. When you log into a device via Telnet, your username and password are sent across the network as cleartext. If an attacker is positioned on the same local network, or at any hop along the internet path, they can use tools like Wireshark or Tcpdump to read your credentials directly from the packets.

In a professional environment, this means a single compromised switch or a rogue device on the network can lead to full administrative access to your servers or networking hardware.

2. Man-in-the-Middle (MITM) Attacks

Because Telnet does not provide a mechanism for server authentication, it is highly susceptible to MITM attacks. An attacker can intercept the connection request to port 23 and masquerade as the legitimate server. The user, thinking they are logging into their router or server, provides their credentials to the attacker's machine. Without the cryptographic signatures found in modern protocols like SSH or TLS, the user has no way to verify they are communicating with the intended recipient.

3. Exploitation by Botnets

Port 23 is one of the most frequently scanned ports on the internet. Automated botnets constantly crawl the IPv4 space looking for open Telnet ports. The most infamous example is the Mirai botnet, which gained control of hundreds of thousands of IoT (Internet of Things) devices—such as IP cameras and home routers—by attempting to log in via port 23 using a list of 60 common default factory passwords. Once compromised, these devices were used to launch some of the largest Distributed Denial of Service (DDoS) attacks in history.

How to Check the Status of Port 23

If you are auditing a network or troubleshooting a connection, you need to know if port 23 is open and listening. Different operating systems offer various tools for this task.

Checking Locally on Windows

On a Windows machine, you can use the command prompt or PowerShell to see if your own system is listening on port 23.

1. Open the Command Prompt as an Administrator.
2. Type the following command: netstat -an | findstr :23
3. If the output shows a line with "LISTENING," the Telnet service is active on your machine. If there is no output, the port is closed.

Checking Locally on Linux or macOS

Linux and macOS users can use the ss or netstat commands. The ss command is generally faster and provides more detail on modern Linux distributions.

1. Open the Terminal.
2. Run: sudo ss -tulpn | grep :23 Or for older systems: netstat -tulpn | grep :23
3. This will identify the specific process ID (PID) that is using the port if it is open.

Scanning Remote Devices

To check if a remote server or router has port 23 open, nmap is the industry-standard tool.

• Command: nmap -p 23 <target-ip-address>

If the result shows "open," the device is potentially vulnerable. If it shows "filtered," a firewall is likely blocking the port. If it shows "closed," no service is listening on that port.

How to Close or Secure Port 23

The best practice for modern networks is to disable Telnet entirely. Most managed switches and routers produced in the last two decades support SSH, which should be the primary method for remote console access.

Disabling Telnet on Windows

Windows does not install the Telnet server by default, but if it has been enabled, you can remove it:

1. Go to "Turn Windows features on or off" in the Control Panel.
2. Uncheck "Telnet Server" (and "Telnet Client" if you don't need to connect to other legacy systems).
3. Click OK and restart if prompted.

Blocking Port 23 via Firewall

If you cannot disable the service on the host itself, you must block it at the firewall level.

On Linux (UFW): sudo ufw deny 23/tcp

On Linux (iptables): sudo iptables -A INPUT -p tcp --dport 23 -j DROP

On Windows Firewall (PowerShell): New-NetFirewallRule -DisplayName "Block Telnet Port 23" -Direction Inbound -LocalPort 23 -Protocol TCP -Action Block

The Secure Alternative: Port 22 (SSH)

The primary replacement for Telnet is SSH, which operates on port 22. Unlike Telnet, SSH encrypts all traffic, including the initial authentication. It also provides host key verification to prevent MITM attacks. Transitioning from Telnet to SSH is the single most effective step you can take to secure remote management interfaces.

When is Port 23 Still Used Today?

Despite its security flaws, port 23 has not disappeared entirely. There are several niche scenarios where it remains in use.

1. Legacy Networking and Industrial Equipment

In many industrial environments, you will find programmable logic controllers (PLCs), lab equipment, or vintage routers that simply do not have the processing power or software updates to support SSH. In these cases, port 23 is often the only way to configure the hardware.

Safety Tip: If you must use Telnet for legacy hardware, ensure that the traffic is encapsulated within a VPN tunnel or restricted to a dedicated, air-gapped management VLAN.

2. Bulletin Board Systems (BBS) and MUDs

For hobbyists, port 23 is a portal to digital history. Many Bulletin Board Systems and Multi-User Dungeons (text-based RPGs) that started in the 80s and 90s are still accessible today via Telnet. These communities use the protocol for its simplicity and low overhead, and since the data being exchanged is usually just game text or public messages, the lack of encryption is often considered an acceptable risk.

3. Network Connectivity Testing

System administrators sometimes use a Telnet client as a quick-and-dirty tool to check if other ports are open. For example, running telnet example.com 80 is a way to see if a web server is responding. If the screen clears or goes blank, the connection was successful. Note that this doesn't use port 23 on the destination; it uses the Telnet client to connect to a different port.

Common Issues and Troubleshooting

If you are trying to use port 23 and experiencing issues, consider the following common causes:

• Connection Refused: The Telnet service is not running on the destination device, or the service is configured to listen on a non-standard port.
• Connection Timed Out: This usually indicates a network-level block. Many modern Internet Service Providers (ISPs) block port 23 traffic by default to prevent the spread of botnets.
• "Telnet is not recognized": In modern versions of Windows, the Telnet client is not installed by default. You must enable it via the "Turn Windows features on or off" menu or via PowerShell using: Enable-WindowsOptionalFeature -Online -FeatureName TelnetClient

Summary of Port 23 Characteristics

Conclusion

TCP port 23 is a relic of an era when the internet was a smaller, more trusting place. While the Telnet protocol it supports was instrumental in the growth of remote computing, its lack of encryption makes it a liability in the 21st century. For any modern professional environment, the rule is simple: if you find port 23 open on your network, you should investigate why, and if possible, close it immediately in favor of SSH on port 22. By understanding the mechanics and risks of this legacy port, you can better protect your infrastructure from credential theft and botnet exploitation.

Frequently Asked Questions

What is the difference between TCP port 22 and port 23?

Port 23 is used for Telnet, which transmits data in plaintext. Port 22 is used for SSH (Secure Shell), which provides an encrypted and authenticated connection. SSH is the secure modern replacement for Telnet.

Can I use Telnet securely?

Strictly speaking, Telnet itself cannot be made secure because it lacks built-in encryption. However, you can use it "securely" by wrapping the connection in an encrypted tunnel, such as a VPN or an SSH tunnel, though it is usually simpler to just use SSH directly.

Is port 23 used for UDP?

While IANA has reserved port 23 for both TCP and UDP, the Telnet protocol almost exclusively uses TCP because it requires the reliable, ordered delivery of characters that TCP provides.

Why do hackers scan for port 23?

Hackers scan for port 23 to find vulnerable IoT devices and legacy servers. They often use automated scripts to try default passwords, aiming to recruit these devices into botnets like Mirai for launching DDoS attacks.

How do I enable the Telnet client on Windows 10 or 11?

Go to the Start menu, type "Turn Windows features on or off," open the result, scroll down to find "Telnet Client," check the box, and click OK. You can then use the telnet command in the command prompt.