BRev Port 23 — Telnet
Telnet is a remote terminal with no encryption of any kind. The username, the password and every keystroke afterwards travel as plain text, so anyone on the path — a shared network segment, a compromised router, an ISP’s transit — reads the session as it happens. It was written when the network between two universities was assumed friendly, and that assumption is the entire vulnerability.
On a modern server, port 23 is almost never a deliberate choice. Where it is genuinely still open is embedded equipment: IP cameras, DVRs, home routers, industrial gateways and set-top boxes shipped with a telnet daemon and a factory password, often undocumented. That is precisely the population Mirai and its successors recruit from — the original Mirai spread with a list of about 60 default credential pairs tried over telnet, and it built a botnet large enough to take out a chunk of the internet.
The replacement is SSH on port 22, which does the same job with authentication and encryption. The only respectable remaining use of the telnet CLIENT is as a crude TCP connection tester — telnet host 443 to see whether a handshake completes — and even that is better served by nc or curl, which say what they mean.
Port 23 at a glance
| Field | Value | Detail |
|---|---|---|
| Port | 23 | Well-known |
| Service | Telnet | Unencrypted remote terminal from the 1970s. (TCP) |
| Category | Remote access | shells, desktops and VPNs |
| Exposure | Never | Never expose to the internet |
Should port 23 face the internet? Everything including your password travels in plain text. This is how IoT botnets recruit.
Bind it to localhost or a private network. Mass scanners find these within minutes of a host appearing online.
What commonly goes wrong
A device on your network answers on 23 and you cannot turn it off
Consumer and industrial hardware frequently hides the telnet daemon from the web UI, or re-enables it after a firmware update. If the setting is not exposed, treat the network as the control: put the device on an isolated VLAN, block 23 outbound at the router so it cannot be reached from the internet, and change the default password anyway. A device you cannot patch is a device you segment.
You are using telnet to test whether a port is open
It works — a banner or a blank screen means the TCP handshake completed — but the exit is unintuitive (Ctrl-] then quit) and it hangs indefinitely on filtered ports. nc -vz says “succeeded!” or “refused” in one line, and curl -v telnet://host:port works anywhere curl exists. Both are on this page.
Check port 23 yourself
No browser can open a raw TCP socket, so no web page can honestly tell you whether this port is open on a remote host. These are the real commands, generated for port 23 — swap example.com for the host you are actually testing.
Is port 23 reachable on another host?
nc -vz example.com 23"succeeded!" means the TCP handshake completed — the port is open. "Connection refused" is closed; a hang until timeout means filtered (a firewall dropped it silently).
nmap -Pn -p 23 example.comThe only common tool that distinguishes open / closed / filtered. -Pn skips the ping sweep, so it still works against hosts that ignore ICMP.
Test-NetConnection example.com -Port 23Read TcpTestSucceeded: True = open. It is built in — nothing to install.
telnet example.com 23A blank screen or a banner means it connected. "Connection refused" means closed. Quit with Ctrl-] then `quit`.
curl -v --max-time 5 telnet://example.com:23Handy when telnet is not installed: "Connected to …" proves the TCP handshake, without curl trying to speak HTTP.
What on this machine is holding port 23?
sudo ss -tlnp | grep :23Lists the listening socket and the PID/program holding it. Drop sudo and you get the socket but not the process name.
sudo lsof -i :23The macOS answer to "address already in use". Kill it with `kill -9 <PID>` once you are sure what it is.
netstat -ano | findstr :23The last column is the PID. Match it in Task Manager’s Details tab, or `taskkill /PID <pid> /F`.
No web page can tell you whether a port is open on a remote host
A browser cannot open a raw TCP socket — there is no API for it, by design. So a site that reports “port 3389 is OPEN on 203.0.113.10” is not checking from your browser; it is asking its own server to scan on your behalf. That works, but it means their server sees the host you asked about, scans from their address rather than yours, and answers a question about their network path, not yours.
We don't have a server here and won't pretend to. So this page does three honest things instead:
| Port | Proto | Service | What it is | Exposure | |
|---|---|---|---|---|---|
| 23 | tcp | Telnet | Unencrypted remote terminal from the 1970s.Everything including your password travels in plain text. This is how IoT botnets recruit. | Neverbrowser-blocked | |
| 123 | udp | NTP | Clock synchronisation.Public NTP servers are normal, but monlist-style queries make a badly configured one a 500x DDoS amplifier. | Carebrowser-blocked | |
| 523 | tcp | IBM Db2 | Db2 database server.A database is never a public service. Put it behind the app. | Never | |
| 623 | udp | IPMI / RMCP | Server baseboard management (iDRAC, iLO, BMC).IPMI 2.0 leaks password hashes to unauthenticated callers. This is out-of-band control of the hardware. | Never | |
| 1723 | tcp | PPTP | Microsoft’s legacy VPN protocol.Never bare. MS-CHAPv2 is broken — PPTP traffic is decryptable. Use WireGuard or OpenVPN. | Neverbrowser-blocked | |
| 2323 | tcp | Telnet alt | Telnet on a second port, common on IoT gear.Exactly what the Mirai botnet scanned for. Disable it. | Never | |
| 2375 | tcp | Docker API | The Docker daemon’s unauthenticated HTTP API.Reaching it is root on the host — one API call mounts the filesystem. Cryptominers scan for it continuously. | Never | |
| 2376 | tcp | Docker API (TLS) | Docker daemon with mutual TLS.Even with certificates this is root-equivalent. Keep it on a private network. | Never | |
| 2379 | tcp | etcd client | Kubernetes’ backing key-value store.etcd holds every cluster secret in the clear. | Never | |
| 2380 | tcp | etcd peer | etcd node-to-node replication.Cluster-internal; joining it means owning the cluster. | Never | |
| 8123 | tcp | Home Assistant | Home Assistant web UI.It controls locks and cameras — 2FA, TLS, and preferably a VPN. | Care | |
| 12345 | tcp | NetBus / misc | The classic NetBus trojan port; also used by odd apps.A listener here deserves investigation. | Never |
http://host:port/ and times it. A connection that is established proves a socket is open; an instant refusal usually means nothing is listening; anything else is honestly reported as “can't tell”. Each attempt gives up after 2.5s.nc -vz example.com 443
nmap -Pn -p 443 example.com
telnet example.com 443
curl -v --max-time 5 telnet://example.com:443
This page cannot answer that, and neither can any other page — from your browser. Opening a TCP connection to an arbitrary host and port is not something JavaScript is allowed to do. Every “open port checker” that gives you a green tick is running the scan on their server. Which is fine, as long as you know what you are agreeing to: they learn which host and port you were worried about, and the answer they give you is about the route from their data centre — not from the internet as your users see it.
What to do instead
Run the check from outside your own network. Copy an nmap or nc line from the card above and run it from a machine that is not behind the same router — a phone on mobile data with a terminal app, a cheap VPS, a colleague's laptop. Running it from inside the LAN tests the LAN, not the internet, and will happily say “open” while the world sees nothing.
Then check the thing that is actually blocking it, in this order: the service is bound to0.0.0.0 and not 127.0.0.1 · the host firewall (ufw, firewalld, Windows Defender Firewall) · the cloud security group or the router's port-forward rule · and finally your ISP, which commonly blocks 25, 80 and 445 on residential lines whatever you configure.
What a browser genuinely can verify
One thing: that an HTTPS service answers. If what you actually want to know is “is my site up and how fast is it”, the latency test measures real round trips to a CORS-open URL. If the name doesn't resolve, or resolves somewhere unexpected, that is a DNS problem, not a port problem — and it is the more common cause of “my port is closed” than an actual firewall.
An IP address finds the machine; a port picks which program on it gets the traffic. TCP sets up a connection first — a handshake, ordered delivery, retransmission — which is why the web, email and SSH use it. UDP just sends the packet with no handshake and no guarantee it arrives, which is why DNS, video calls and games use it: late data is worse than lost data.
That difference is why a UDP port is so much harder to test. TCP either completes a handshake or it doesn't, so a tool can tell you. A UDP service that has nothing to say to an unexpected packet stays silent — and silence looks identical to a firewall dropping it.
The three ranges
0–1023Assigned by IANA to core services. On Unix, binding one needs root (or CAP_NET_BIND_SERVICE).1024–49151Registered by vendors for their applications. Any user can bind these — which is why every dev server lives here.49152–65535Never assigned. The OS hands these out as the SOURCE port of your outgoing connections. (Linux actually uses 32768–60999 by default.)Closed is not the same as filtered
Closed means the host answered: the packet arrived, nothing is listening, and you got an immediate refusal (a TCP RST). Filtered means nothing answered at all — a firewall dropped your packet in silence, so you wait for a timeout and learn nothing. The difference matters: closed proves the host is reachable and the port is free; filtered tells you only that something between you and it is discarding traffic.nmap reports the two separately. A browser cannot distinguish them, which is why this page reports a timeout as “can't tell” rather than guessing.
The one habit worth keeping
Bind services to 127.0.0.1 instead of 0.0.0.0 unless something outside the machine genuinely needs them, and reach them over SSH or a VPN. Every database on the never-expose list above ships with that advice, and the leaks all begin the same way: a default bind address, a cloud instance with a public IP, and a scanner that found it within the hour.
The blocked-port list this page uses is the WHATWG Fetch Standard's “bad port” table — the ports every browser refuses to connect to (Chrome calls it ERR_UNSAFE_PORT). Local probing is additionally gated by Chrome's Local Network Access permission, which replaced Private Network Access and ships in Chrome 142.
FAQ
Is telnet ever safe to use?
Only inside a trusted, isolated segment where nothing sensitive is typed — a serial-console server on a management VLAN, for instance. Across any network you do not fully control, the credentials are readable by anyone in the path, so the answer is no.
Why is port 23 the most attacked port on the internet?
Because millions of embedded devices still run it with factory passwords, and each one is a full shell. Automated scanners find a listening telnet port and try a short credential list; the yield is high enough to keep the scanning perpetual.
What replaces telnet?
SSH on port 22 for interactive access, and for device management specifically, anything with a modern authenticated protocol — SSH, HTTPS with a real certificate, or an out-of-band console. Never a telnet daemon reachable from a routable network.