Common attacks and weaknesses
- Clusters without authentication leaking billions of records.
- Index deletion and ransom notes.
- Old versions with remote code execution (Groovy scripting).
Port 9200: Elasticsearch
Elasticsearch and OpenSearch HTTP API (IANA lists 9200 for WAP, but on the Internet it is almost always Elasticsearch).
9200
How Elasticsearch works
Databases & cachesA search query goes to port 9200 and the engine returns the matching documents, ranked. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 9/10 critical if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Databases & caches
Is port 9200 dangerous?
How to secure it
- Enable security (authentication and TLS), on by default since 8.0.
- Bind to private addresses.
- Put Kibana and the API behind a reverse proxy with SSO.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 9200
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| wap-wsp | 9200 | TCP, UDP | WAP connectionless session service | - | - |
// source: IANA service name and port number registry
Which program uses port 9200, and is it reachable?
Linux
sudo ss -ltnup 'sport = :9200' # process listening on 9200
sudo lsof -nP -i :9200macOS
sudo lsof -nP -i :9200
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 9200 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 9200 netstat -ano | findstr :9200
From another machine
nmap -p 9200 -sV <host> sudo nmap -sU -p 9200 <host> nc -zv <host> 9200
Block it in the firewall
sudo ufw deny 9200/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 9200" -Direction Inbound -LocalPort 9200 -Protocol TCP -Action Block # Windows
What is port 9200 used for?
Elasticsearch and OpenSearch HTTP API (IANA lists 9200 for WAP, but on the Internet it is almost always Elasticsearch).
Is port 9200 TCP or UDP?
Port 9200 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 9200?
It is rated 9/10 (critical) when exposed to the Internet. Clusters without authentication leaking billions of records. Enable security (authentication and TLS), on by default since 8.0.
How do I check if port 9200 is open?
On Linux run "ss -ltnup 'sport = :9200'", on macOS "lsof -nP -i :9200", and on Windows "netstat -ano | findstr :9200" to see the local process. From another machine, "nmap -p 9200 <host>" shows whether it is reachable.
Other databases & caches ports
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :6379 Redis tcp · critical risk :27017 MongoDB tcp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk :5984 CouchDB tcp · udp · high risk