Subnet and PortsRemote access ports: SSH 22, Telnet 23, RDP 3389 and VNC 5900
What the IANA registry records for these ports, and how to use them safely.
What IANA records
| Port | Protocols | Registered name | IANA description | Assignee | Reference | Note |
|---|---|---|---|---|---|---|
| 22 | tcp, udp, sctp | ssh | The Secure Shell (SSH) Protocol | n/a | [RFC 4251] | Defined TXT keys: u=<username> p=<password> |
| 23 | tcp, udp | telnet | Telnet | Jon Postel | [RFC 854] | Defined TXT keys: u=<username> p=<password> |
| 3389 | tcp, udp | ms-wbt-server | MS WBT Server | Jordan Marchese | n/a | |
| 5900 | tcp, udp | rfb | Remote Framebuffer | Tristan Richardson | [RFC 6143] |
Why this group matters most
Remote access ports let someone control a computer from far away, which makes them valuable to attackers. Servers that have SSH or Remote Desktop open to the internet are tried by automated password guessers within minutes of going online.
The ports
- 22, SSH (Secure Shell): an encrypted command-line login and file transfer. The right choice for managing Linux and network devices.
- 23, Telnet: an old command-line login that sends everything, including passwords, in plain text. Replace it with SSH wherever you can.
- 3389, Remote Desktop (registered as
ms-wbt-server): Microsoft's remote desktop protocol, a full graphical login. - 5900, VNC (registered as
rfb): a graphical remote control protocol. Many VNC setups are weakly protected unless tunnelled.
Safe habits
- Do not expose these ports to the whole internet. Allow only your own address, or put them behind a VPN.
- Use keys or strong passwords plus two-step verification. For SSH, use key-based login and turn off password login.
- Keep the software updated. Remote access services have had serious security flaws.
- Consider a different port only as a small extra: changing the port reduces noise in logs, but it is not security.
- Log and watch failed logins. Many failed attempts in a short time mean someone is guessing.
If you must support a home user
Use a tool that makes an outgoing connection and requires the user to accept (so no inbound port is open) instead of opening 3389 on a home router.
This is an independent guide. It is not connected with IANA, the IETF or any network equipment maker. Address and port data come from the IANA registries as fetched on 14 November 2026; RFC texts were read from rfc-editor.org. Check the originals for anything you rely on.