Common attacks and weaknesses
- Unauthenticated reads of cluster configuration and secrets.
Port 2181: ZooKeeper
Apache ZooKeeper client port.
2181
How ZooKeeper works
Messaging & queuesThe client sends a request to port 2181 and the ZooKeeper service answers. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 7/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Messaging & queues
Is port 2181 dangerous?
How to secure it
- Enable SASL authentication and restrict to cluster members.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 2181
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| eforward | 2181 | TCP, UDP | eforward | - | - |
// source: IANA service name and port number registry
Which program uses port 2181, and is it reachable?
Linux
sudo ss -ltnup 'sport = :2181' # process listening on 2181
sudo lsof -nP -i :2181macOS
sudo lsof -nP -i :2181
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 2181 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 2181 netstat -ano | findstr :2181
From another machine
nmap -p 2181 -sV <host> sudo nmap -sU -p 2181 <host> nc -zv <host> 2181
Block it in the firewall
sudo ufw deny 2181/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 2181" -Direction Inbound -LocalPort 2181 -Protocol TCP -Action Block # Windows
What is port 2181 used for?
Apache ZooKeeper client port.
Is port 2181 TCP or UDP?
Port 2181 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 2181?
It is rated 7/10 (high) when exposed to the Internet. Unauthenticated reads of cluster configuration and secrets. Enable SASL authentication and restrict to cluster members.
How do I check if port 2181 is open?
On Linux run "ss -ltnup 'sport = :2181'", on macOS "lsof -nP -i :2181", and on Windows "netstat -ano | findstr :2181" to see the local process. From another machine, "nmap -p 2181 <host>" shows whether it is reachable.
Other messaging & queues ports
:5672 AMQP (RabbitMQ) tcp · udp · sctp · high risk :9092 Apache Kafka tcp · udp · high risk :15672 RabbitMQ management tcp · high risk :1881 IBM WebSphere MQ Everyplace tcp · udp :2230 MetaSoft Job Queue Administration Service tcp · udp :2664 Patrol for MQ GM tcp · udp :2665 Patrol for MQ NM tcp · udp :2873 PubSub Realtime Telemetry Protocol tcp · udp