Secure Shell utilizes client-server architecture: by default, the server listens to TCP port 22, which has been officially assigned for Secure Shell, and clients initiate connections to this port. The listener port can be changed in the server configuration.

Secure Shell defines a packet-based protocol that runs over a reliable transport stream, usually TCP. The protocol does not run over UDP.