Common attacks and weaknesses
- PLAINTEXT listeners without authentication exposing every topic.
Port 9092: Apache Kafka
Kafka broker.
9092
How Apache Kafka works
Messaging & queuesApplications append events to an ordered log; consumers read it from any position. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 7/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Messaging & queues
Is port 9092 dangerous?
How to secure it
- Use SASL with TLS listeners and topic ACLs.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 9092
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| XmlIpcRegSvc | 9092 | TCP, UDP | Xml-Ipc Server Reg | - | 2006-01 |
// source: IANA service name and port number registry
Which program uses port 9092, and is it reachable?
Linux
sudo ss -ltnup 'sport = :9092' # process listening on 9092
sudo lsof -nP -i :9092macOS
sudo lsof -nP -i :9092
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 9092 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 9092 netstat -ano | findstr :9092
From another machine
nmap -p 9092 -sV <host> sudo nmap -sU -p 9092 <host> nc -zv <host> 9092
Block it in the firewall
sudo ufw deny 9092/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 9092" -Direction Inbound -LocalPort 9092 -Protocol TCP -Action Block # Windows
What is port 9092 used for?
Kafka broker.
Is port 9092 TCP or UDP?
Port 9092 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 9092?
It is rated 7/10 (high) when exposed to the Internet. PLAINTEXT listeners without authentication exposing every topic. Use SASL with TLS listeners and topic ACLs.
How do I check if port 9092 is open?
On Linux run "ss -ltnup 'sport = :9092'", on macOS "lsof -nP -i :9092", and on Windows "netstat -ano | findstr :9092" to see the local process. From another machine, "nmap -p 9092 <host>" shows whether it is reachable.
Other messaging & queues ports
:5672 AMQP (RabbitMQ) tcp · udp · sctp · high risk :2181 ZooKeeper tcp · udp · high risk :15672 RabbitMQ management tcp · high risk :1881 IBM WebSphere MQ Everyplace tcp · udp :2230 MetaSoft Job Queue Administration Service tcp · udp :2664 Patrol for MQ GM tcp · udp :2665 Patrol for MQ NM tcp · udp :2873 PubSub Realtime Telemetry Protocol tcp · udp