Running SSH on a different port sounds like good advice because the automated scanning tools tend to focus on port 22. However, if you're vulnerable to the sca

Running SSH on a different port sounds like good advice because the automated scanning tools tend to focus on port 22. However, if you're vulnerable to the scanners then you haven't actually addressed the vulnerability they exploit. What you're looking at is a form of security by obscurity that reduces the number of low end attacks, but if someone port scans you, finds the SSH port and runs the same attacks you're still going to get compromised. Another thing to consider is that if you're moving SSH ports your OS will still respond to requests to connect over SSH by telling the scanners that there's no SSH service running on that port. If you're being metered for bandwidth by bytes transferred it shouldn't be a lot (unless you're getting really hammered by it, which tends to happen when the IP address has been previously compromised). The correct way to deal with this is to use only public key authentication (which stops people getting in through password brute forcing) and to block the port with a firewall with exceptions for the places that you access it from. You can find out where you're accessing it from by going through the SSH logs. By all means swap ports if you want to, but don't rely on it alone.