TCP Port 23 – Telnet (Legacy Remote Terminal)
Port 23 is the standard port for Telnet, an early protocol for logging into remote computers across a terminal connection. Telnet predates the public internet itself, with origins in the late 1960s and a formal specification in RFC 854 published in 1983. For the first three decades of network computing it was the universal way to access a remote shell over a network. It has since been replaced almost entirely by SSH on port 22 for one reason: Telnet sends every keystroke (including passwords) across the network in plaintext, where any device on the network path can read them.
The transition from Telnet to SSH was effectively complete on internet-facing systems by the early 2000s. Today, the only contexts where Telnet still appears are legacy embedded devices that were built before SSH was practical (older industrial equipment, ancient network gear, certain consumer-grade IoT devices), internal lab and testing environments where convenience outweighs security, and as a network diagnostic tool (“telnet some.host 80” to test whether a TCP connection can be opened to a given port).
Outbound TCP/23 from end-user devices is highly unusual outside the diagnostic-tool case. Inbound TCP/23 from the public internet to any host is unusual in 2026 and is generally considered a configuration mistake.
Port 23 is also defined for UDP in the IANA registry, but UDP/23 is not used in practice. Telnet requires the reliable, ordered, persistent connection that TCP provides.
About TCP Port 23
Port 23 carries the IANA assignment for telnet. The IANA description reads: ‘Telnet’.
Security Considerations
Telnet on port 23 is a known security risk by design, and exposing it to the public internet in 2026 is widely considered a serious configuration mistake. The protocol transmits credentials and session contents in plaintext, with no built-in encryption or modern authentication. Anyone on the network path between client and server can read everything sent, including the password used to log in. This was a tolerable tradeoff in the 1980s when the protocol was specified; it has not been an acceptable one since SSH became broadly deployed in the early 2000s.
A wide range of IDS rules references this port. The dominant present-day threat is the Mirai botnet, which accounts for a large share of the rules tied to port 23. Mirai propagates by scanning the public internet for Telnet servers with factory-default username and password combinations, then enrolling the compromised devices into a botnet used primarily for distributed denial of service attacks. The original Mirai operation was notable for the October 2016 attack against the DNS provider Dyn, which made large parts of the consumer internet (Twitter, Netflix, Spotify, GitHub, and many others) unreachable for hours. Variants of the Mirai codebase have continued to operate ever since, and IoT devices exposing Telnet with default credentials remain a primary recruitment target.
Beyond Mirai, the IDS rules referencing port 23 preserve a long history of Linux server rootkit detections from the 1990s and early 2000s, when Telnet-accessible Unix servers were the typical compromise target. Sample rules in our dataset detect specific historical rootkit families (w00w00, lrkr0x, satori) and generic backdoor login attempts. Most of these threats are no longer active in the wild, but the rules remain useful for detecting attacks against unpatched legacy systems or honeypots.
Common practice today is straightforward: do not expose Telnet to the public internet, ever. Replace Telnet with SSH where remote access is needed. For embedded devices that genuinely cannot run SSH, restrict Telnet to a known internal network range, change all default credentials, and ideally place the device behind a VPN.
Inbound TCP/23 from the public internet is a strong signal that something is misconfigured (a forgotten device, a default-credentialed router exposed by a misbehaving ISP, a deliberately set up honeypot). Outbound TCP/23 from a residential or office endpoint to an unfamiliar destination is uncommon and worth investigating, as it may indicate a compromised device participating in IoT botnet scanning activity.
IDS Rule References
86 IDS / security rules reference TCP port 23. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.
Rule categories (top 6): attempted-admin (55), bad-unknown (7), trojan-activity (5), suspicious-login (5), successful-admin (4), attempted-user (4).
Sample rule descriptions for TCP port 23:
- MALWARE-BACKDOOR w00w00 attempt
- MALWARE-BACKDOOR attempt
- MALWARE-BACKDOOR MISC r00t attempt
- MALWARE-BACKDOOR MISC rewt attempt
- MALWARE-BACKDOOR MISC Linux rootkit attempt
Malware Rule References
A meaningful share of the IDS rules that reference this port are malware related.
42 of the 86 IDS rules that reference TCP port 23 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.
Families observed (top 8): Mirai (26), Linux (4), Flooder (1), HidePak (1), HideSource (1), Netwire_RAT (1), Solaris (1), Sourtoff (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).