Telnet Protocol Specification

TELNET was designed with server-user symmetry so that terminal-terminal (linking) and server-server (distributed computation) use cases are naturally supported, not just the classic user-to-server remote login scenario.

The DO/DON'T/WILL/WON'T option negotiation syntax was deliberately kept simple so that hosts which do not understand an option can trivially refuse it by returning WON'T or DON'T. Richer negotiation (e.g., sub-negotiation of line length) must be preceded by a standard DO/WILL exchange that establishes mutual understanding before exotic syntax is used.

The IAC (255) escape byte was chosen as the command prefix to minimize collisions with data bytes. Only IAC itself must be doubled to appear as data; all other 255 byte values pass transparently, avoiding pervasive escaping overhead.

The Network Virtual Terminal (NVT) was introduced as an imaginary standard intermediate device so that neither user nor server hosts need to maintain information about each other's terminal characteristics. Each end maps its local conventions to appear as an NVT, eliminating the combinatorial problem of per-host terminal handling.

ip

The NVT defaults to half-duplex, line-buffered operation to reduce the high cost of processing network input interrupts on many hosts. Data is accumulated until a complete line is ready or an explicit local signal to transmit occurs.

Higher-level protocols that use TELNET SHOULD use the sequence [IP, Synch] as their out-of-band signal. The Urgent notification wakes the TELNET process; the embedded IP wakes the next higher-level process. A separate protocol-level DM analog may follow if defined by that protocol.

Multiple Synch signals sent in rapid succession may have their TCP Urgent notifications merged by the network, so receivers cannot count Urgent signals. Processing must continue until DM is found regardless of the Urgent count; if Urgent data is indicated after a DM, a subsequent Synch is implied.

tcp

When the AO function is received, the server SHOULD return a TELNET Synch to the user to clear any buffers external to the server (in the network and the user's local host) that may hold pending output data.

A NUL received in the data stream after a CR (absent options specifying otherwise) SHOULD be stripped before applying NVT-to-local character-set mapping. The CR NUL / CR LF rules apply symmetrically in both directions.

A party may always refuse a request to enable an option, and MUST never refuse a request to disable an option, since all parties must be prepared to support the baseline NVT.

For remote terminal access, the TELNET server MUST listen on well-known TCP port 23 (octal 27). The server can handle many simultaneous connections on port 23 because each TCP connection is identified by the (server-port, user-port) pair.

tcp

In the data stream, a bare carriage return MUST be encoded as the two-byte sequence CR NUL (13, 0); the sequence CR LF (13, 10) MUST be treated as a single new-line and used only when both carriage return and line feed are intended. A lone CR byte MUST be avoided in other contexts to allow rational disambiguation.

Rejected option requests SHOULD NOT be repeated until something changes (e.g., the process changes state, the user intervenes, or new information arrives from the remote end). Repeating rejected requests can create nonterminating request loops.

The Synch signal MUST be sent by transmitting the DATA MARK (DM, code 242) as the last (or only) data octet in a TCP send operation with the Urgent flag set. DM marks the end of the urgent data region; the receiver scans for interesting signals and discards intervening data until DM is found.

tcp

To prevent infinite acknowledgment loops in option negotiation, a party MUST NOT send a request to enter a mode it is already in, and MUST NOT acknowledge (respond to) an apparent request to enter a mode it is already in. A response is required only when a mode change is actually requested.

When a process at one end of a TELNET connection cannot proceed without input from the other end (i.e., its output queue is empty and no input is queued), it MUST transmit the TELNET Go Ahead (GA, code 249) command to signal the user-side host to yield the terminal to the user.

Whenever an option command affects processing of data being sent from party A to party B, the command MUST be inserted in the data stream at the point where the effect is desired, not sent out-of-band.

Five standard NVT control functions are defined: Interrupt Process (IP, code 244) — suspend/abort a user process; Abort Output (AO, code 245) — run process to completion but discard output; Are You There (AYT, code 246) — elicit visible evidence the system is alive; Erase Character (EC, code 247) — delete last character; Erase Line (EL, code 248) — delete current input line.

Sub-negotiation allows richer parameter exchange after basic DO/WILL agreement: SB (code 250) introduces the sub-negotiation data, and SE (code 240) terminates it. Sub-negotiation MUST NOT begin until a prior DO/WILL exchange has confirmed mutual understanding of the option.

The TELNET Synch mechanism consists of a TCP Urgent notification paired with the DATA MARK command in the data stream. On receiving Urgent, the receiver enters a mode that scans for 'interesting' signals (IP, AO, AYT, all TELNET commands) and discards intervening data until the DM is encountered, then resumes normal processing.

tcp

RFC 854 defines no authentication, encryption, or integrity protection. All data, including credentials typed at the NVT keyboard, is transmitted in plaintext over the TCP connection. The protocol predates modern security requirements and should be considered inherently insecure for use over untrusted networks.

security

All TELNET commands are encoded as at least a 2-byte sequence: IAC (byte 255) followed by the command code. Option negotiation commands are 3 bytes: IAC, command code (WILL=251, WON'T=252, DO=253, DON'T=254), option code. To send byte value 255 as data, it must be doubled (IAC IAC).

TELNET command codes: SE=240, NOP=241, Data Mark=242, Break=243, IP=244, AO=245, AYT=246, EC=247, EL=248, GA=249, SB=250, WILL=251, WON'T=252, DO=253, DON'T=254, IAC=255. These have defined meaning only when immediately preceded by IAC.

The NVT character set is 7-bit USASCII in an 8-bit field. The NVT printer recognizes NUL (0, no-op), LF (10, next line same column), and CR (13, left margin) as required; BEL (7), BS (8), HT (9), VT (11), and FF (12) have defined but non-required effects. Codes 32–126 are the 95 printable USASCII graphics.