Port 2222 (SSH alternate)

The most common non-standard SSH port: used for a second SSH daemon, Gitea/GitLab containers' SSH, DirectAdmin and honeypots.

Registered (user) port, 1024-49151 TCP Remote access Expose only to trusted sources

What port 2222 is used for

The most common non-standard SSH port: used for a second SSH daemon, Gitea/GitLab containers' SSH, DirectAdmin and honeypots.

Security: should port 2222 be open?

Expose only to trusted sources. Same rules as port 22: keys only, no root login, allowlist where possible. Scanners check 2222 right after 22.

IANA assignment

Service nameProtoDescriptionAssigneeReference

EtherNet-IP-1 TCP EtherNet/IP I/O IANA assigned this well-formed service name as a replacement for "EtherNet/IP-1".
New contact added for port 2222 on 2008-02-01 Brian Batke 2 -

EtherNet/IP-1 TCP EtherNet/IP I/O
New contact added for port 2222 on 2008-02-01 This entry is an alias to "EtherNet-IP-1". This entry is now historic, not usable for use with many common service discovery mechanisms. Brian Batke 2 -

EtherNet-IP-1 UDP EtherNet/IP I/O IANA assigned this well-formed service name as a replacement for "EtherNet/IP-1".
New contact added for port 2222 on 2008-02-01 Brian Batke 2 -

EtherNet/IP-1 UDP EtherNet/IP I/O
New contact added for port 2222 on 2008-02-01 This entry is an alias to "EtherNet-IP-1". This entry is now historic, not usable for use with many common service discovery mechanisms. Brian Batke 2 -

Check what is listening on port 2222

Linux: is anything listening on TCP 2222?

sudo ss -tlnp 'sport = :2222'

Linux / macOS: which process owns the port

sudo lsof -nP -i :2222

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':2222 '

Windows (Command Prompt)

netstat -ano | findstr :2222

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2222 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 2222

From Windows

Test-NetConnection HOST -Port 2222

Allow only trusted sources on port 2222 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 2222 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 2222 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2222 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 2222 accept
sudo nft add rule inet filter input tcp dport 2222 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 2222 trusted' -Direction Inbound -Protocol TCP -LocalPort 2222 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.