A Linux machine may need to reach a service on another host, and a port check can show whether a TCP connection gets through. The telnet command attempts that connection and lets you interact with the endpoint.
I’ll explain how to run the check and how to interpret its response.
TL;DR
The telnet command opens an interactive TCP connection to a host and optional port. Use it for a permitted reachability check, not a secure login.
- Run telnet with a host and port to connect to a service.
- Without a port, the client uses the standard Telnet service port, 23.
- Press Ctrl+] and enter quit to leave a connected session.
- Use SSH for remote administration because Telnet sends data without encryption.
What Is the telnet Command in Linux?
Telnet is both the name of a terminal protocol and the name commonly used for its command-line client. It is used for legacy terminal access and simple TCP reachability checks.
TCP provides an ordered byte stream between two endpoints. TELNET adds control information for interactive terminal use. The protocol specification assigns port 23 to remote terminal access, but a client can be pointed at another TCP port for a diagnostic connection.
Installing the client gives you a command for outbound connections. A Telnet server is a separate service, and exposing plaintext remote login carries avoidable risk.
Telnet sends session data without encryption. Someone observing the network path may read it, including credentials. Use SSH for an interactive shell.
Choose a protocol-aware tool when testing an application protocol.
The system manual describes the options installed on your distribution. Run man telnet to read it, or learn how to use the man command in Linux.
How to Use telnet to Check a Host and Port
Use the client on a host you are authorized to test, and specify the service port you expect to reach. This sequence identifies whether the command exists, explains the syntax, and shows how to end a session.
Step 1: Check whether the telnet client is installed
Package names vary by distribution and release. Check the configured package index before installing the client.
command -v telnet
A printed path means the shell can find the client. If no path appears, check the package available in your configured repositories before installing.
Install the telnet client on Ubuntu or Debian
On Ubuntu and Debian, refresh the APT package index and install the client package. This installs the client package.
sudo apt update
sudo apt install telnet
Debian-based releases may package the implementation as inetutils-telnet, while telnet can be a metapackage. If APT cannot locate it, search with apt-cache search telnet and choose the client package. Confirm the executable with command -v telnet.
Install the telnet client on CentOS or RHEL
On RHEL-family systems, DNF installs the package named telnet when an enabled repository provides it.
sudo dnf install telnet
Older releases may use YUM. If the package is unavailable, check the approved repository for your release. Verify the client with command -v telnet.
A listener accepts incoming connections. Enabling a Telnet service or opening port 23 is a separate server-administration task.
Check UFW safely before changing firewall rules
UFW is a host firewall. Inspect its current policy with sudo ufw status verbose because outbound defaults and network firewalls vary.
sudo ufw status verbose
For an authorized exception, scope the rule to the destination and TCP port. The example sudo ufw allow out to 203.0.113.10 port 443 proto tcp permits outbound TCP to that documentation address. Substitute an approved destination and remove temporary rules after the test.
Firewall changes can interrupt SSH access. Review the full ruleset and preserve management access before changing it. A router, cloud security group, or remote firewall may also control the connection.
Step 2: Connect to the hostname and service port
The command accepts a hostname or IP address and an optional port. Get the destination and port from service documentation or its administrator. A different port tests a different endpoint.
telnet example.com 80
This command attempts a TCP connection to example.com on port 80. A successful connection makes the client wait for input. It confirms the endpoint accepted TCP at that time, not that the application works.
When you omit the port, the client attempts the standard Telnet service port, 23. State the port explicitly to make the target clear. Use an authorized host and port.
Step 3: Read the connection response
A successful connection may leave a blank screen while the service waits for a protocol-specific request. For HTTP, send a request with HTTP syntax. HTTPS begins with a TLS handshake, which Telnet does not perform.
To troubleshoot a web page, use curl to make an HTTP request. To check ICMP echo reachability, use the Linux ping command. Ping tests ICMP, while Telnet attempts TCP to a particular port.
Step 4: Exit the session cleanly
While connected, press Ctrl+] to enter the Telnet client’s command mode. The prompt changes to telnet>. Type quit there to close the client session and return to your shell.
Ctrl-]
telnet> quit
Ctrl+] is the client escape character in this workflow. Consult the local manual if the client uses a different setting.
What Do Telnet Results Mean?
Connection messages help distinguish a rejected TCP attempt from a connection that never receives a response. Treat them as evidence about the network path and endpoint, not as a complete application health check.
| Result | What it indicates | Next check |
|---|---|---|
| Connected | TCP handshake completed to the selected host and port. | Send a valid request with the correct protocol tool. |
| Connection refused | The connection was actively rejected, often because no service is listening or a device rejected it. | Confirm the destination, port, service state, and policy with the administrator. |
| Timeout | No response arrived before the client gave up. | Check routing, access controls, firewall policy, and whether the host is reachable. |
| Name resolution error | The hostname could not be resolved to an address. | Check spelling and DNS resolution before testing the port. |
A refusal usually arrives promptly. A timeout means the attempt received no useful response within the wait period. Neither message identifies which network device or configuration caused the result.
Do not infer that the whole host is down from one failed port. Another service on that machine may still be reachable, and the target service may restrict which source addresses can connect. Compare with an approved test from another network path or ask the service owner to confirm its access policy.
Mail servers may wait for an SMTP greeting, while web servers expect an HTTP request. Use OpenSSL client for a TLS handshake check.
Do not enter passwords or private data into an untrusted Telnet session. For remote shell access, use SSH with a verified host and account. Only probe systems you are authorized to test.
When the shell says telnet: command not found, the client is missing or not on the executable search path. Confirm the package for your distribution and install only the client.
A refusal points to the destination port and listener. A timeout calls for checking the network path and filtering rules.
Edge Cases to Check
DNS can return multiple addresses, so a hostname test may reach an unexpected endpoint. Check the resolver with getent ahosts HOSTNAME.
| Case | Symptom | Fix |
|---|---|---|
| Multiple DNS addresses | The hostname test reaches an unexpected endpoint. | Run getent ahosts HOSTNAME and test the intended address. |
| Service waits for protocol data | The connection opens and appears idle. | Use the matching protocol client, such as curl for HTTP. |
| Idle interactive session | The service waits while the session stays open. | Press Ctrl+] and enter quit, or use a diagnostic tool with a timeout. |
| Observation | Interpretation | Safe next step |
|---|---|---|
| Expected port appears in the zone | The local policy includes a matching rule, but another network control may still filter traffic. | Check the remote policy and test from an authorized source. |
| Expected port is absent | The active zone does not show that port as an allowed service. | Confirm the intended zone and service before requesting a change. |
| No active zone is shown | The interface may be managed differently or the firewall service may not be active. | Check the host’s documented firewall manager without changing its state. |
Disable an Unneeded Telnet Service
Disable a Telnet server when a host no longer needs to accept legacy remote terminal connections. First identify whether a listener exists and which service manages it. The client package alone does not accept incoming sessions.
ss -ltn
systemctl status telnet.socket
The listening-socket list shows local TCP listeners, while the status check reports whether that named socket unit is present and active. Unit names differ across distributions, so use the package documentation and service inventory for the host rather than assuming this name applies everywhere.
For a managed system, have the administrator disable the relevant Telnet server unit and remove any firewall allowance that is no longer needed. Verify both the listener and the network policy afterward. Do not remove the client if administrators still use it for an approved outbound diagnostic.
Choose the Right Next Diagnostic
Telnet answers a narrow question: did a TCP connection to this host and port complete? Choose the next tool based on the layer that still needs checking.
| Question | Useful check | What it tests |
|---|---|---|
| Does the name resolve? | getent ahosts example.com | System name-service lookup results. |
| Can the host answer ICMP echo? | ping -c 2 example.com | ICMP echo behavior, subject to filtering. |
| Does an HTTP endpoint respond? | curl -I http://example.com | An HTTP request and response. |
| Can a TLS service negotiate encryption? | openssl s_client -connect example.com:443 -servername example.com | TLS negotiation for the named endpoint. |
These checks answer different questions, and a network policy may allow one while denying another. For a single TCP port probe, use Telnet only when it is installed and the target is within your authorization.
Start Building a Safe Test
Start with the service owner’s hostname and documented port, then record the time and network from which you tested. This makes a result useful to someone diagnosing the other end without turning a basic probe into an unapproved scan.
- Confirm that you are permitted to test the endpoint.
- Choose one expected service port instead of sweeping a range.
- Run the connection attempt and note whether it connects, refuses, or times out.
- Use the matching application client when you need to verify the service itself.
A successful TCP handshake is a useful boundary: it shows that a listener accepted the connection at that moment. It does not validate a login, certificate, HTTP route, or application response. Keep those checks with the protocol-aware client that understands them.
For distribution-specific installation, check the package manager’s current candidate before making changes. A package name may point to a compatibility package or depend on enabled repositories, so verify the installed command afterward with command -v telnet.
Keep the test bounded to the one endpoint in the ticket or service request. A port scan or repeated probing is a different activity and can trigger monitoring or violate the target’s rules. If a single attempt times out, collect the exact hostname, port, time, source network, and message so the service owner can compare it with server-side logs.
Conclusion: Use Telnet for Reachability Checks
Use Telnet for a TCP reachability check against a known host and port. Interpret the result at the network layer, then choose a protocol-aware tool for the application.
Use the exact protocol client for the next layer: SSH for remote access, curl for HTTP, or a TLS client for encrypted services. Read the netcat guide when you need a more flexible TCP or UDP diagnostic.
FAQ
These answers cover the common installation and session questions.
How do I exit the telnet command in Linux?
Press Ctrl+] to open the client command prompt, then type quit and press Enter.
What does the telnet command do in Linux?
It opens an interactive TCP connection to a host and optional port, commonly for legacy terminal access or a basic reachability check.
Does installing the telnet client start a Telnet server?
No. The client initiates outbound connections. A server is a separate service that listens for incoming connections.
Can Telnet test an HTTPS port?
It can attempt a TCP connection to that port, but it cannot perform the TLS handshake. Use a TLS-aware client to test HTTPS.