TCP Port 23 – Telnet (Legacy Remote Terminal)
Port 23 is the standard port for Telnet, an early protocol for logging into remote computers across a terminal connection. Telnet predates the public internet itself, with origins in the late 1960s and a formal specification in RFC 854 published in 1983. For the first three decades of network computing it was the universal way to access a remote shell over a network. It has since been replaced almost entirely by SSH on port 22 for one reason: Telnet sends every keystroke (including passwords) across the network in plaintext, where any device on the network path can read them.
The transition from Telnet to SSH was effectively complete on internet-facing systems by the early 2000s. Today, the only contexts where Telnet still appears are legacy embedded devices that were built before SSH was practical (older industrial equipment, ancient network gear, certain consumer-grade IoT devices), internal lab and testing environments where convenience outweighs security, and as a network diagnostic tool (“telnet some.host 80” to test whether a TCP connection can be opened to a given port).
Outbound TCP/23 from end-user devices is highly unusual outside the diagnostic-tool case. Inbound TCP/23 from the public internet to any host is unusual in 2026 and is generally considered a configuration mistake.
Port 23 is also defined for UDP in the IANA registry, but UDP/23 is not used in practice. Telnet requires the reliable, ordered, persistent connection that TCP provides.
About TCP Port 23
Port 23 carries the IANA assignment for telnet. The IANA description reads: ‘Telnet’.
Security Considerations
Telnet on port 23 is a known security risk by design, and exposing it to the public internet in 2026 is widely considered a serious configuration mistake. The protocol transmits credentials and session contents in plaintext, with no built-in encryption or modern authentication. Anyone on the network path between client and server can read everything sent, including the password used to log in. This was a tolerable tradeoff in the 1980s when the protocol was specified; it has not been an acceptable one since SSH became broadly deployed in the early 2000s.
Our data shows 87 IDS rules referencing this port. The dominant present-day threat is the Mirai botnet, which appears in 26 rules tied to port 23. Mirai propagates by scanning the public internet for Telnet servers with factory-default username and password combinations, then enrolling the compromised devices into a botnet used primarily for distributed denial of service attacks. The original Mirai operation was notable for the October 2016 attack against the DNS provider Dyn, which made large parts of the consumer internet (Twitter, Netflix, Spotify, GitHub, and many others) unreachable for hours. Variants of the Mirai codebase have continued to operate ever since, and IoT devices exposing Telnet with default credentials remain a primary recruitment target.
Beyond Mirai, the IDS rules referencing port 23 preserve a long history of Linux server rootkit detections from the 1990s and early 2000s, when Telnet-accessible Unix servers were the typical compromise target. Sample rules in our dataset detect specific historical rootkit families (w00w00, lrkr0x, satori) and generic backdoor login attempts. Most of these threats are no longer active in the wild, but the rules remain useful for detecting attacks against unpatched legacy systems or honeypots.
Common practice today is straightforward: do not expose Telnet to the public internet, ever. Replace Telnet with SSH where remote access is needed. For embedded devices that genuinely cannot run SSH, restrict Telnet to a known internal network range, change all default credentials, and ideally place the device behind a VPN.
Inbound TCP/23 from the public internet is a strong signal that something is misconfigured (a forgotten device, a default-credentialed router exposed by a misbehaving ISP, a deliberately set up honeypot). Outbound TCP/23 from a residential or office endpoint to an unfamiliar destination is uncommon and worth investigating, as it may indicate a compromised device participating in IoT botnet scanning activity.
IDS Rule References
86 IDS / security rules reference TCP port 23. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): attempted-admin (55), bad-unknown (7), trojan-activity (5), suspicious-login (5), successful-admin (4), attempted-user (4).
Sample rule descriptions for TCP port 23:
- MALWARE-BACKDOOR w00w00 attempt
- MALWARE-BACKDOOR attempt
- MALWARE-BACKDOOR MISC r00t attempt
- MALWARE-BACKDOOR MISC rewt attempt
- MALWARE-BACKDOOR MISC Linux rootkit attempt
Malware Activity
A meaningful share of monitored traffic on this port involves malware indicators.
42 of 86 IDS rules for TCP port 23 involve malware activity.
Families observed (top 8): Mirai (26), Linux (4), Flooder (1), HidePak (1), HideSource (1), Netwire_RAT (1), Solaris (1), Sourtoff (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).