Changing the SSH port does not stop scanning

Moving SSH from 22 to 2222 does reduce brute-force noise, but it does not make anything safer.

The whole internet scans all 65535 ports daily. A different port filters opportunistic noise; targeted scanning still finds it. What actually helps: disable password auth, keys only, restrict source addresses, fail2ban as a backstop.

Two side effects: security groups must be updated, and some corporate or campus networks only allow 22 — you lock yourself out.

If quieter logs are the goal, changing the port works. If intrusion is the concern, PasswordAuthentication no and PermitRootLogin prohibit-password buy far more.