TELNET (Teletype Network) Protocol

1. Overview and Historical Role

TELNET (RFC 854) was developed in 1969 as one of the earliest Application Layer protocols on the ARPANET. It provides a bidirectional, interactive text-oriented communication facility, allowing a user at a local terminal to log into and execute commands on a remote host computer as if sitting directly in front of it (Remote Login).

Underlying Transport: Runs over TCP Port 23 (reliable, connection-oriented).
Client-Server Architecture:
- TELNET Client: Runs on the user's local workstation, capturing keyboard strokes and displaying received text output.
- TELNET Server: Runs as a background daemon (e.g., telnetd) on the remote host, spawning pseudo-terminals (PTYs) and executing shell commands.

  Local Host                                               Remote Host
 +------------------+                                     +------------------+
 | User / Terminal  |                                     | Operating System |
 +------------------+                                     +------------------+
          |                                                        ^
          v                                                        |
 +------------------+       TCP Connection (Port 23)      +------------------+
 |  TELNET Client   | <=================================> |  TELNET Server   |
 +------------------+    Network Virtual Terminal (NVT)   +------------------+

2. The Network Virtual Terminal (NVT) Concept

In heterogeneous networks, different manufacturers manufactured proprietary hardware terminals with incompatible character encodings, newline behaviors ( vs ), and control key combinations (e.g., IBM 3270 vs DEC VT100).

To bridge this incompatibility without writing a translator for every pair of machines ( $O(n^2)$ complexity), TELNET invented the Network Virtual Terminal (NVT):

  Local Terminal ──> [ Client translates Local to NVT ]
                               |
                               v
                     Transmitted across TCP as NVT
                               |
                               v
  [ Server translates NVT to Remote OS ] ──> Remote Shell

NVT Character Set: Standard 7-bit ASCII embedded in 8-bit bytes (highest bit = 0).
Control Characters: Specific byte sequences define universal actions:
- CR LF (Carriage Return + Line Feed): Universal end of line.
- IP (Interrupt Process): Suspends the currently executing program (equivalent to Ctrl+C).
- AO (Abort Output): Flushes output display while allowing the program to run.
- AYT (Are You There?): Requests remote confirmation that the system is responsive.

3. Options Negotiation & TELNET Commands

TELNET allows clients and servers to dynamically negotiate terminal capabilities (such as terminal type, line width, character echo) using a symmetrical four-verb negotiation mechanism:

 Verb       Meaning
----------------------------------------------------------------------
 WILL       Sender offers to enable a feature itself.
 WONT       Sender refuses to enable (or disables) a feature.
 DO         Sender requests that the receiver enable a feature.
 DONT       Sender demands that the receiver disable a feature.

Interpret As Command (IAC): Because data and control commands share the same TCP stream, the special byte 255 (0xFF) is reserved as the IAC prefix. When the receiver sees 0xFF, it interprets the subsequent bytes as an internal command rather than text.

4. The Critical Vulnerability: Plaintext Transmission

TELNET was created in an era when the Internet was an academic, trusted network. It lacks any form of cryptographic encryption or integrity validation:

Every keystroke, including usernames, root passwords, and database queries, is sent in clear, unencrypted plaintext over TCP!
An attacker running a simple packet sniffer (like Wireshark or tcpdump) on any intermediate router or Wi-Fi hotspot can trivially read the administrative password in cleartext.

The Modern Replacement: Secure Shell (SSH)

Because of this fatal flaw, TELNET is strictly banned in modern network infrastructure and has been completely replaced by SSH (Secure Shell - RFC 4251):

Runs on TCP Port 22.
Uses public-key cryptography (RSA, Ed25519) and symmetric ciphers (AES-256) to encrypt all traffic end-to-end, guaranteeing confidentiality, authentication, and message integrity.

5. Key Exam Questions & Takeaways

What is the Network Virtual Terminal (NVT) in TELNET?
- An abstract, universal terminal model with standardized ASCII character sets and control commands. The client translates its local terminal format into NVT, and the server translates NVT into the remote operating system's native format, enabling interoperability across heterogeneous computers.
What transport protocol and port does TELNET use?
- TCP Port 23.
Explain why TELNET is considered insecure and identify its replacement.
- TELNET transmits all data, including credentials and administrative passwords, in unencrypted plaintext, leaving it vulnerable to packet sniffing and man-in-the-middle attacks. It has been superseded by SSH (Secure Shell) on TCP Port 22.
What is the meaning of the IAC byte in TELNET?
- IAC stands for Interpret As Command (value $255$ / 0xFF), indicating that the following bytes represent protocol commands rather than user data.

TELNET