CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Databases & caches

Port 9200: Elasticsearch

Elasticsearch and OpenSearch HTTP API (IANA lists 9200 for WAP, but on the Internet it is almost always Elasticsearch).

Elasticsearch REST APIOpenSearch
9200

How Elasticsearch works

Databases & caches
app:9200"error"2 hits app:9200"error"2 hits

A search query goes to port 9200 and the engine returns the matching documents, ranked. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP · UDP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
Databases & caches
01 Security

Is port 9200 dangerous?

Common attacks and weaknesses

  • Clusters without authentication leaking billions of records.
  • Index deletion and ransom notes.
  • Old versions with remote code execution (Groovy scripting).

How to secure it

  • Enable security (authentication and TLS), on by default since 8.0.
  • Bind to private addresses.
  • Put Kibana and the API behind a reverse proxy with SSO.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 9200

ServicePortTransportDescriptionReferenceUpdated
wap-wsp 9200 TCP, UDP WAP connectionless session service - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 9200, and is it reachable?

Linux

sudo ss -ltnup 'sport = :9200'      # process listening on 9200
sudo lsof -nP -i :9200

macOS

sudo lsof -nP -i :9200

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 9200 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 9200
netstat -ano | findstr :9200

From another machine

nmap -p 9200 -sV <host>
sudo nmap -sU -p 9200 <host>
nc -zv <host> 9200

Block it in the firewall

sudo ufw deny 9200/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 9200" -Direction Inbound -LocalPort 9200 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 9200 used for?

Elasticsearch and OpenSearch HTTP API (IANA lists 9200 for WAP, but on the Internet it is almost always Elasticsearch).

Is port 9200 TCP or UDP?

Port 9200 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 9200?

It is rated 9/10 (critical) when exposed to the Internet. Clusters without authentication leaking billions of records. Enable security (authentication and TLS), on by default since 8.0.

How do I check if port 9200 is open?

On Linux run "ss -ltnup 'sport = :9200'", on macOS "lsof -nP -i :9200", and on Windows "netstat -ano | findstr :9200" to see the local process. From another machine, "nmap -p 9200 <host>" shows whether it is reachable.

05 Related
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :6379 Redis tcp · critical risk :27017 MongoDB tcp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk :5984 CouchDB tcp · udp · high risk

Latest vulnerability news

All news