NetSecWallFree trialDownload
Port 22 · TCP

Port 22: SSH

Secure Shell: encrypted remote command lines, file copies (SFTP, SCP) and Git over SSH.

Protocol
TCP
On Windows
sshd.exe (OpenSSH Server, an optional Windows feature)
Risk if open to the internet
High

Seeing it on your PC

Windows 10 and 11 include the OpenSSH client, so ssh.exe, git.exe or an editor connecting out to port 22 is normal. A listener on 22 means OpenSSH Server, WSL or another SSH server is installed and running.

Should you block it?

Outgoing is fine. Only accept incoming SSH if you use it, and then with key-based sign-in. An SSH server reachable from the internet is scanned and guessed at all day.

Check it on your PC

Run this in PowerShell to see what is using port 22 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 22 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 22" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.