Port 23Telnet

What port 23 is used for

Telnet opens a bidirectional text channel to a remote system. Whatever you type is sent, byte by byte, to the far end; whatever it prints comes back. In the 1980s and 1990s that was how administrators reached Unix hosts, routers and mainframes. The protocol has no encryption and no integrity protection, so a username and password typed into a Telnet session are readable by anyone on the network path.

Today, port 23 open on a device tells you one of three things:

1. It is old network equipment whose management interface predates SSH or where SSH was never enabled.
2. It is an embedded or IoT device (camera, DVR, router, printer) with a Telnet daemon compiled in. Mirai and similar botnets spread by logging into exactly these devices with default passwords.
3. It is a hobby service such as a MUD, BBS or the occasional retro-computing project.

Telnet as a port tester

Because the client just opens a TCP connection, telnet host 443 was for years the quick way to check whether a port answered. A blank screen meant the connection succeeded. PowerShell's Test-NetConnection -Port and curl provide the same test with clearer output, and neither requires enabling an optional feature. See Test-NetConnection.

Security considerations

• Disable Telnet on every device that offers an alternative. Switches, routers and NAS units almost always support SSH or HTTPS management.
• Never use Telnet across an untrusted network. Credentials and session content are exposed.
• Treat an unexpected port-23 listener as a finding. On a Windows PC, nothing should listen on 23; if something does, identify the process. On the LAN, an IoT device with Telnet open should be isolated and updated or replaced.
• Block 23 at the perimeter in both directions unless there is a documented need.

How to check port 23

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :23

A line in the LISTENING state means a local program has bound port 23; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :23 or lsof -i :23.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 23

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 23. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Firewall considerations

Inbound TCP 23 should be blocked everywhere except on isolated management networks for equipment that cannot be upgraded. Outbound 23 can usually be blocked as well; the client is rarely needed and the block prevents credentials from crossing the network in clear text.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 23 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.