# How do I find all SSH servers on our network, including forgotten ones?

Combine an active scan with passive observation, because each finds what the other misses. An authorised scan of your address ranges for port 22 and other common SSH ports, with a tool such as Nmap, lists every host that answers and the software version it announces. Check your cloud consoles and DNS records for servers outside the office ranges. Passive observation adds what scans miss: SSH on unusual ports, servers reachable only from certain segments, and how SSH is actually used, meaning which clients connect to which servers and when. Then go through the list with owners: every server needs a named person, a reason to exist and a patch schedule, and anything nobody claims gets switched off after a notice period. Restrict SSH to administrators' networks or a jump host, and use keys instead of passwords. NetSenX alerts on every plan when a host starts reaching many internal hosts on administration ports such as SSH, which is how scanning and lateral movement look.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/how-to-find-all-ssh-servers-on-the-network

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do I check which servers run an OpenSSH version affected by a new CVE?](https://netsenx.com/en/faq/how-to-check-openssh-versions-against-a-new-cve)
- [Does an SSH version banner prove a server is vulnerable?](https://netsenx.com/en/faq/does-an-ssh-version-banner-prove-a-server-is-vulnerable)
- [Can NetSenX detect threats in encrypted traffic?](https://netsenx.com/en/faq/can-netsenx-detect-threats-in-encrypted-traffic)
- [Can NDR detect threats in encrypted traffic without decrypting it?](https://netsenx.com/en/faq/can-ndr-detect-threats-in-encrypted-traffic-without-decrypting-it)
- [What does NetSenX read from an encrypted connection?](https://netsenx.com/en/faq/what-does-netsenx-read-from-an-encrypted-connection)