# WHATPORT(1022)

## NAME

port 1022 — exp2 — RFC 3692-style experiment — The second RFC 4727 experiment port, and the one people actually squat on — often with SSH.

Protocol: TCP  
IANA: exp2

## DESCRIPTION

1022 is exp2, the partner to 1021 in RFC 4727's pair of ports reserved for RFC 3692-style experimentation across TCP, UDP, SCTP and DCCP. Its registration is identical to 1021's, but nmap's data shows 1022 open several times more often, which reflects services parked on it rather than experiments being run. Moving SSH to a nonstandard low port is a common reason; shared hosting providers in particular have used 1022 and 2222 this way. Confirm by banner: a real SSH server announces itself in cleartext on connect.

## EXPOSURE

**Expose with care.** If it is SSH it is still SSH — the odd port buys quieter logs, not security, so key-only authentication still does the actual work. If it is something else, it is a production service on a port reserved for experiments.

## CHECK

```sh
nc -v -w 3 TARGET 1022
```

## SEE ALSO

- spec — [RFC 4727 — Experimental Values in IPv4, IPv6, ICMP, UDP, TCP headers](https://www.rfc-editor.org/rfc/rfc4727.html) (rfc-editor.org)
- iana — [IANA port registry — 1022](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1022) (iana.org)
- source — [nmap-services (1022/tcp exp2)](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/1022/> · JSON: <https://whatport.net/1022.json> · full dataset: <https://whatport.net/ports.json>