Port reference
Port 7000 (TCP) – Apache Cassandra Inter-node
Default port for Cassandra inter-node (gossip and replication) communication.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Cassandra uses 7000 for node-to-node gossip and replication, often without inter-node encryption enabled. The port should never face the internet, yet misconfigured clusters expose it on 0.0.0.0.
What is port 7000 used for?
Port 7000 is the default port for Apache Cassandra inter-node communication, the gossip and replication traffic that Cassandra nodes exchange to coordinate the cluster and copy data across the ring. It is used only between the nodes of a Cassandra cluster, not by applications, which connect on the CQL client port 9042 instead.
When would you open it?
You only need 7000 reachable between the nodes of your own Cassandra cluster, for example across the private network of a multi-node deployment. Application clients and users never connect here, so it should not be opened to anything beyond cluster members.
Is it safe to open?
Exposing 7000 beyond your cluster is risky, so keep it on a private network firewalled to the member nodes only and enable inter-node TLS encryption. See the security notes below.
How to check if this port is open
ss -tulpn | grep :7000
nmap -p 7000 <target>netstat -ano | findstr :7000
Test-NetConnection <host> -Port 7000lsof -i :7000
nmap -p 7000 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 7000 to your device's local IP, internal port 7000, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 7000/tcpsudo firewall-cmd --permanent --add-port=7000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7000 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 7000" -Direction Inbound -Protocol TCP -LocalPort 7000 -Action AllowSecurity & risks
Common attacks
- Joining a rogue node to the cluster to read or inject replicated data
- Interception of unencrypted gossip and replication traffic
- Cluster disruption and denial of service against the ring
- Reconnaissance of cluster topology and keyspaces
Hardening
- Bind listen_address to a private interface; never expose 7000 to the internet
- Enable internode_encryption (TLS) for gossip and replication
- Firewall 7000 to cluster member IPs only
- Keep client CQL (9042) and JMX (7199) restricted as well
- Keep Cassandra patched and audit cluster membership
How to block this port
sudo ufw deny 7000/tcpsudo firewall-cmd --permanent --remove-port=7000/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 7000 -j DROPNew-NetFirewallRule -DisplayName "Block 7000" -Direction Inbound -Protocol TCP -LocalPort 7000 -Action Blocknmap snippet
nmap -p7000 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Should Cassandra port 7000 ever be exposed to the internet?
- No. Port 7000 carries inter-node gossip and replication and must stay on a private network, firewalled to cluster members only. Exposing it can let a rogue node join the ring and access replicated data.
- How do I secure inter-node traffic on 7000?
- Enable internode_encryption with TLS, bind listen_address to a private interface, and firewall 7000 so only known cluster member IPs can connect.