CyberHunter
Local dataset, no network
// DevOps, cloud & containers

Port 8500: Consul

HashiCorp Consul HTTP API.

8500

How Consul works

DevOps, cloud & containers
adminhostregister adminhostregister

Commands sent to port 8500 create and control containers or cluster resources on the host. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
8/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 8500 dangerous?

Common attacks and weaknesses

  • Without ACLs, attackers can register services with scripts and execute commands.

How to secure it

  • Enable ACLs (default deny), disable script checks, use TLS.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 8500

ServicePortTransportDescriptionReferenceUpdated
fmtp 8500 TCP, UDP Flight Message Transfer Protocol - 2003-12

// source: IANA service name and port number registry

03 Check it

Which program uses port 8500, and is it reachable?

Linux

sudo ss -ltnup 'sport = :8500'      # process listening on 8500
sudo lsof -nP -i :8500

macOS

sudo lsof -nP -i :8500

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 8500 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 8500
netstat -ano | findstr :8500

From another machine

nmap -p 8500 -sV <host>
sudo nmap -sU -p 8500 <host>
nc -zv <host> 8500

Block it in the firewall

sudo ufw deny 8500/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 8500" -Direction Inbound -LocalPort 8500 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 8500 used for?

HashiCorp Consul HTTP API.

Is port 8500 TCP or UDP?

Port 8500 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 8500?

It is rated 8/10 (high) when exposed to the Internet. Without ACLs, attackers can register services with scripts and execute commands. Enable ACLs (default deny), disable script checks, use TLS.

How do I check if port 8500 is open?

On Linux run "ss -ltnup 'sport = :8500'", on macOS "lsof -nP -i :8500", and on Windows "netstat -ano | findstr :8500" to see the local process. From another machine, "nmap -p 8500 <host>" shows whether it is reachable.

05 Related
:2375 Docker API (HTTP) tcp · critical risk :2376 Docker API (TLS) tcp · high risk :6443 Kubernetes API tcp · udp · high risk :10250 Kubelet API tcp · critical risk :2379 etcd tcp · critical risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news