How Telnet Works and Why It Is Insecure: Clear-Text Logins (Animated)

Telnet gives a remote command line, like SSH, but with no encryption at all. Each key you press is sent as its own readable packet. It still appears on old routers, switches, cameras and IoT devices, which is why the Mirai botnet could take over hundreds of thousands of them.

1. Connect: the device asks who you are

After the TCP handshake on port 23, the device sends a login prompt as plain text.

1. DATA (Old router / switch → Your laptop): The prompt arrives as readable text.

Wireshark filter:

telnet

2. Typing the login: one packet per key press

Telnet sends each character as you type it, and the device echoes it back.

1. DATA (Your laptop → Old router / switch): Five packets: a, d, m, i, n.
2. DATA (Old router / switch → Your laptop): The device asks for the password. It hides the characters on your screen, but not on the wire.
3. DATA (Your laptop → Old router / switch): Eight more packets spell the password.
4. DATA (Old router / switch → Your laptop): Logged in with full control of the device.

Wireshark filter:

telnet.data

3. Sniff the session: attack: follow the stream

A sniffer simply reassembles the characters. In Wireshark: right-click → Follow → TCP Stream.

1. SNIFFED (Router → Attacker): The attacker now owns the router: they can read its config, redirect traffic or lock the admins out.

Wireshark filter:

tcp.port == 23

4. Disable telnet: defence: ssh only

Turn Telnet off and allow only SSH on management interfaces, reachable only from an admin network.

1. TELNET SYN (Your laptop → Old router / switch): Port 23 no longer answers.
2. SSH (Your laptop → Old router / switch): Admins use SSH instead; a sniffer sees only encrypted bytes.

Router config (cisco):

line vty 0 4
 transport input ssh
ip ssh version 2

FAQ