Common attacks and weaknesses
- Unauthenticated metrics revealing internal hostnames and versions.
- Admin consoles with weak credentials.
Port 9090: Prometheus / admin consoles
Common default for Prometheus and several web admin consoles (Cockpit).
9090
How Prometheus / admin consoles works
Monitoring & loggingThe monitoring server collects metrics, alerts or logs from devices over port 9090. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Monitoring & logging
Is port 9090 dangerous?
How to secure it
- Put behind a reverse proxy with authentication.
- Restrict to monitoring networks.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 9090
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| websm | 9090 | TCP, UDP | WebSM | - | - |
// source: IANA service name and port number registry
Which program uses port 9090, and is it reachable?
Linux
sudo ss -ltnup 'sport = :9090' # process listening on 9090
sudo lsof -nP -i :9090macOS
sudo lsof -nP -i :9090
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 9090 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 9090 netstat -ano | findstr :9090
From another machine
nmap -p 9090 -sV <host> sudo nmap -sU -p 9090 <host> nc -zv <host> 9090
Block it in the firewall
sudo ufw deny 9090/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 9090" -Direction Inbound -LocalPort 9090 -Protocol TCP -Action Block # Windows
What is port 9090 used for?
Common default for Prometheus and several web admin consoles (Cockpit).
Is port 9090 TCP or UDP?
Port 9090 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 9090?
It is rated 6/10 (high) when exposed to the Internet. Unauthenticated metrics revealing internal hostnames and versions. Put behind a reverse proxy with authentication.
How do I check if port 9090 is open?
On Linux run "ss -ltnup 'sport = :9090'", on macOS "lsof -nP -i :9090", and on Windows "netstat -ano | findstr :9090" to see the local process. From another machine, "nmap -p 9090 <host>" shows whether it is reachable.