Port 5222 – XMPP Client

TCP

Port 5222 is the XMPP (Jabber) client-to-server port for instant messaging, presence, and real-time communication. XMPP on port 5222 supports STARTTLS encryption and SASL authentication. Used by ejabberd, Prosody, and formerly by Google Talk and Facebook Messenger before they switched to proprietary protocols.

Port Number

5222

Protocol

TCP

Service

XMPP Client-to-Server

Range

IANA Registered (1024–49151)

Description

XMPP client connections on port 5222 provide federated instant messaging using XML streams. Clients authenticate via SASL (PLAIN, SCRAM-SHA-1, or SCRAM-SHA-256) and negotiate TLS via STARTTLS. The protocol supports one-to-one messaging, multi-user chat (MUC), file transfer, and presence. XMPP federation means any server can communicate with any other server (via port 5269), similar to email. This federated model powers both public networks (jabber.org, conversations.im) and private deployments (corporate chat). Modern XMPP implementations require STARTTLS and certificate verification for both client (5222) and server-to-server (5269) connections.

Security risks

1STARTTLS stripping: without mandatory TLS enforcement (require-encryption in server config), a MITM can strip the STARTTLS offer and force plaintext communication
2CVE-2022-0030 (ejabberd): authentication bypass via crafted SASL response – unauthenticated attacker could impersonate any user (fixed ejabberd 22.05)
3Federation opens attack surface: XMPP's federated model means any external server can attempt to exchange messages. Malicious servers can probe for valid JIDs (user@domain) and enumerate accounts
4Message archiving exposure: XMPP servers with MAM (Message Archive Management) store full conversation history – database compromise exposes all historical messages
5In-band registration abuse: if IBR (XEP-0077) is enabled, anyone can create accounts programmatically without human verification – spambots and abuse accounts

Firewall guidance

Port 5222 should be accessible from client networks (users connecting via XMPP clients). Enforce TLS: set c2s_require_encryption = true (Prosody) or s2s_use_starttls = required (ejabberd). Disable in-band registration unless you have CAPTCHA verification. For private deployments (no federation): block port 5269 entirely and restrict 5222 to internal networks.

Diagnosis commands

Test XMPP STARTTLS connection and certificate

shell

openssl s_client -connect server:5222 -starttls xmpp -xmpphost domain.com

Extract XMPP server info (software version, supported features)

shell

nmap -p 5222 --script xmpp-info target

Prosody: check server status and loaded modules

shell

prosodyctl status

ejabberd: count currently connected users

shell

ejabberdctl connected_users_number

Usage examples

Port 5222 – XMPP Client

shell

prosodyctl status
ejabberdctl connected-users
profanity -a [email protected]

Common services on this port

ejabberdProsodyOpenfireTigaseMongooseIM

Related ports

5222

XMPP client-to-server (this port)

5223

XMPP client SSL (legacy, implicit TLS)

5269

XMPP server-to-server (federation)

5280

XMPP BOSH/WebSocket (HTTP binding)

History

XMPP (originally Jabber) was created by Jeremie Miller in 1999 as an open, federated instant messaging protocol. Port 5222 was assigned for client connections. XMPP became an IETF standard (RFC 6120/6121, 2011). Google Talk used XMPP federation (2005-2014) before closing it. WhatsApp's backend is based on modified ejabberd. Today XMPP powers enterprise messaging (Cisco Jabber used it), IoT (XEP-0323), and privacy-focused chat (Conversations app, Snikket).

FAQ

Is XMPP still relevant in 2024?

Yes, for specific use cases: (1) privacy-focused messaging (end-to-end encryption via OMEMO, federated = no single company controls it), (2) IoT device communication (lightweight, real-time, XEP extensions for sensors), (3) enterprise chat (on-premises deployment, full data control), (4) gaming chat (many games use XMPP internally). Not relevant for: consumer messaging (Signal/WhatsApp won), or team collaboration (Slack/Teams won).

XMPP vs Matrix – which federated protocol to choose?

XMPP: mature (25 years), lighter protocol, better for low-bandwidth/IoT, massive extension ecosystem (XEPs), simpler server setup. Matrix: newer (2014), built-in E2E encryption (Megolm), better media handling, room-based model (like Discord/Slack), bridges to other platforms. Choose XMPP for: lightweight messaging, IoT, existing Jabber infrastructure. Choose Matrix for: modern team chat replacement, bridging to Slack/Discord/IRC, organizations wanting a Slack alternative.

Specification

RFC 6120 – Port 5222 specification →