Skip to content
ProtocolPorts

Port reference

Port 4369 (TCP) – Erlang Port Mapper Daemon (epmd)

Name server that maps Erlang node names to the TCP ports of their distribution listeners.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
High

Frequently targeted — restrict exposure and harden it.

Default state

Often listening on all interfaces wherever an Erlang/Elixir app runs (RabbitMQ, CouchDB, ejabberd). epmd itself needs no auth; the real gate is the Erlang distribution cookie.

What is port 4369 used for?

Port 4369 runs epmd, the Erlang Port Mapper Daemon. It's a small directory service: when an Erlang or Elixir program clusters with others, each node registers its name with epmd, which tells other nodes which port to use to reach it. You'll find it running automatically wherever Erlang-based software runs in a cluster — notably RabbitMQ, CouchDB, and ejabberd.

When would you open it?

Open port 4369 only between the trusted servers in an Erlang/Elixir cluster (for example RabbitMQ nodes that need to talk to each other), and only on a private network. It should never be opened to the internet.

Is it safe to open?

epmd has no authentication and, combined with a weak Erlang cookie, can lead to remote code execution on the host. Keep it on a private interface, firewall it to cluster members, and use a long random cookie. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :4369
nmap -p 4369 <target>
Windows
netstat -ano | findstr :4369
Test-NetConnection <host> -Port 4369
macOS
lsof -i :4369
nmap -p 4369 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 4369 to your device's local IP, internal port 4369, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 4369/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=4369/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 4369 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 4369" -Direction Inbound -Protocol TCP -LocalPort 4369 -Action Allow

Security & risks

Common attacks

  • Enumerating Erlang node names and distribution ports via epmd
  • Distributed-Erlang RCE using a weak, default, or guessable cookie
  • Pivoting into RabbitMQ, CouchDB, or ejabberd back ends
  • Information disclosure about clustered nodes and topology

Hardening

  • Never expose 4369 or the distribution port range to the internet
  • Bind epmd to localhost or a private interface (ERL_EPMD_ADDRESS)
  • Use a long, random Erlang cookie and protect ~/.erlang.cookie permissions
  • Firewall epmd and the dynamic distribution ports to trusted cluster hosts
  • Enable TLS for Erlang distribution and patch the BEAM runtime

How to block this port

Linux (ufw)
sudo ufw deny 4369/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=4369/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 4369 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 4369" -Direction Inbound -Protocol TCP -LocalPort 4369 -Action Block

nmap snippet

nmap -p4369 --script epmd-info <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 5672Port 5984Port 25672Port 6379

Frequently asked questions

Is epmd itself authenticated?
No. epmd is just a name-to-port directory and answers anyone who connects. Security depends entirely on the Erlang distribution cookie and on firewalling both 4369 and the dynamic distribution ports.
How does port 4369 lead to remote code execution?
Once an attacker learns a node name from epmd and knows or guesses the shared cookie, they can join the Erlang cluster as a node and evaluate arbitrary code on the target — full RCE on RabbitMQ, CouchDB, or ejabberd hosts.

Related guides