why ssh uses UDP port randomly?

[Ricky_4]

Hi All,

In my understanding, SSH services only uses TCP port 22. But why SSH uses random UDP port. Below is one of valid user using ssh.

Please help me why SSH uses UDP port so I can explain as well to our auditor.

Thanks in advance.

Adricatico



# ./lsof -nP -i udp:47515
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 24309 pm23510 4u IPv4 0x30002bed0d0 0t0 UDP *:47515 (Idle)

# ps -ef | grep 24309 | grep -v grep
pm23510 24311 24309 0 Mar 11 pts/1 0:00 -zsh
pm23510 24309 24306 0 Mar 11 ? 0:01 /export/opt/SCssh/3.7.1_C0/sbin/sshd

[rick jones · Accepted solution]

Perhaps that was a socket used to send/recv DNS queries. If you tusc trace the start of the sshd you might see exactly what it uses the UDP _socket_ for