The second RFC 4727 experiment port, and the one people actually squat on — often with SSH.
1022 is exp2, the partner to 1021 in RFC 4727's pair of ports reserved for RFC 3692-style experimentation across TCP, UDP, SCTP and DCCP. Its registration is identical to 1021's, but nmap's data shows 1022 open several times more often, which reflects services parked on it rather than experiments being run. Moving SSH to a nonstandard low port is a common reason; shared hosting providers in particular have used 1022 and 2222 this way. Confirm by banner: a real SSH server announces itself in cleartext on connect.
Expose with care
If it is SSH it is still SSH — the odd port buys quieter logs, not security, so key-only authentication still does the actual work. If it is something else, it is a production service on a port reserved for experiments.
$ nc -v -w 3 TARGET 1022Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.