TCP Port 22000 – Syncthing (P2P File Synchronization)
Port 22000 is the default sync port for Syncthing, an open-source peer-to-peer file synchronization application that lets users keep folders synchronized across multiple devices without a central server. Syncthing was started by Jakob Borg in 2013 and has since become a widely-deployed alternative to commercial cloud-sync services like Dropbox, Google Drive, and OneDrive, with a particular following among users who want their data to stay on their own devices rather than on a third-party server.
The protocol Syncthing speaks on TCP/22000 is called BEP (Block Exchange Protocol). When a Syncthing device wants to sync a folder with another device, it opens a TCP connection to the other device on port 22000, performs a TLS 1.3 handshake using cryptographic device IDs that the two devices have previously exchanged, and then synchronizes file metadata and content blocks over the encrypted channel. Newer Syncthing versions also support QUIC-based connections on UDP/22000 for environments where TCP performance is poor or where NAT traversal needs the additional flexibility QUIC provides. A separate local-discovery mechanism on UDP/21027 (outside the scope of this editorial) is used for devices to find each other on the same LAN.
The architectural property that distinguishes Syncthing from commercial sync services is that no central server holds the data. Each device is an authenticated peer, and folders sync directly between devices that have explicitly added each other by device ID. The cryptographic device IDs are 52-character base32-encoded strings derived from each device’s TLS certificate, and adding a remote device requires both sides to enter the other’s ID and accept the introduction. This makes accidental over-sharing structurally difficult.
Inbound TCP/22000 is normal on devices running Syncthing where the operator has configured the device to accept incoming sync connections. Inbound TCP/22000 to a host that is not running Syncthing is unusual. Outbound TCP/22000 from a Syncthing device to other authorized devices, including across the public internet to home or remote-office machines, is the protocol working as designed.
The IANA registration for this port (“snapenetio”) is an obscure historical entry unrelated to Syncthing’s use of the port.
About TCP Port 22000
The Internet Assigned Numbers Authority (IANA) registers port 22000 for snapenetio. The IANA description reads: ‘SNAPenetIO’.
Security Considerations
Our data shows zero IDS rules referencing port 22000. The rule sets in this dataset are oriented toward exploit detection and broad-protocol-abuse patterns; Syncthing is not a common target for protocol-level exploitation, and its peer-to-peer architecture means that the typical attack surface (a centralized server vulnerable to credential theft, mass data exfiltration, or supply-chain compromise) does not exist. As with the few other ports in this dataset that have no IDS rule activity, the absence should be read as “no rule-data evidence” rather than “no security considerations.”
The most relevant security-design property of Syncthing is that authentication and encryption are not optional. Devices identify each other by cryptographic certificate-derived IDs, all traffic on port 22000 runs through TLS 1.3 (or DTLS over QUIC for the UDP variant), and there is no anonymous or unauthenticated mode. A device that has not been explicitly added by both sides cannot sync with another Syncthing device. This eliminates a large class of misconfiguration risks that affect other file-sharing protocols.
The remaining attack surface is therefore narrower than for protocols with weaker default postures, but it is not zero. Risks worth mentioning include compromise of a Syncthing-running endpoint (which then becomes a sync source for whatever folders the compromised device is configured to share), accidental sharing of sensitive folders due to operator mistake (Syncthing’s permissioning is per-folder, and a user who adds a remote device with default settings may give it more access than intended), and the general supply-chain considerations that apply to any open-source software with auto-update behavior.
Inbound TCP/22000 from the public internet to a host that is running Syncthing and has been configured to accept external connections is normal. Inbound TCP/22000 to a host that is not running Syncthing is unusual and may indicate either that another service has been misconfigured to use the same port or that an unauthorized Syncthing instance is running on the host. Outbound TCP/22000 from end-user devices to other Syncthing peers across the public internet is normal in setups where users sync between home and other devices; it is uncommon on tightly managed corporate networks where Syncthing is not approved as a sanctioned tool.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry.