Telnet

Telnet is one of the original Internet application protocols, defined in RFC 854 (May 1983). It provides a bidirectional, 8-bit byte stream — a “Network Virtual Terminal” (NVT) — over TCP, with the server (telnetd) listening on the well-known port TCP 23. The protocol’s one interesting feature is IAC (Interpret As Command, byte 0xFF): an in-band escape that introduces option negotiation (WILL/WONT/DO/DONT) for things like echo control, terminal type, and line mode, letting client and server agree on how the virtual terminal behaves.

Security posture

Telnet transmits everything — including credentials — in cleartext, with no integrity protection. On any untrusted network it is fully sniffable (see tcpdump) and trivially session-hijackable. It was functionally replaced by ssh for remote administration in the late 1990s, and a live telnetd on a modern network is a finding in itself: legacy gear, embedded devices, and forgotten management interfaces are where it persists.

Modern uses of the client

The telnet client survives as a universal bare-TCP debugging tool, precisely because the protocol is almost nothing:

telnet 10.0.0.5 80      # manual HTTP: type "GET / HTTP/1.0" and Enter twice
telnet mail.example 25  # manual SMTP conversation (see [[smtp]])
telnet 10.0.0.5 443     # quick TCP reachability probe (no TLS, just the connect)

For anything beyond ASCII hand-typing, netcat is the better raw-TCP tool (scriptable, UDP-capable, no IAC byte-mangling), and Test-NetConnection / powershell-port-scanning cover the same probe on Windows.

Operational notes

• Banner-grabbing a suspected telnetd with nc works fine, but note the IAC negotiation bytes (FF FB ...) at the start of a real telnetd greeting — a parser that chokes on non-ASCII will show them as garbage.
• Finding open TCP 23 during recon (via nmap) is high-value: either a legacy service worth attacking directly or a credential-harvesting/sniffing opportunity if users actually authenticate.

Sources

• RFC 854 — Telnet Protocol Specification (Postel & Reynolds, May 1983)
• telnet(1) — Linux man page (die.net)

Related

• ssh — the encrypted replacement that obsoleted telnet for administration
• netcat — the modern raw-TCP/UDP successor for client-side use
• tcp — the transport telnet runs on (port 23)