Port reference
Port 9092 (TCP) – Apache Kafka
Default broker port for Apache Kafka, the distributed event-streaming and messaging platform.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Kafka brokers listen on 9092 with no authentication or encryption by default, so any client reaching the port can list topics, consume messages, and produce data.
What is port 9092 used for?
Port 9092 is the default broker port for Apache Kafka, the widely used distributed event-streaming platform that acts as a high-throughput message bus. Producers publish records to topics and consumers read them over 9092, using client libraries for Java, Python (kafka-python), Go, and more, plus CLI tools like kafka-console-producer. Kafka-compatible systems such as Redpanda also use it. Older Kafka deployments rely on ZooKeeper (2181) for cluster metadata.
When would you open it?
Open or forward 9092 when producer and consumer applications run on different machines from the Kafka brokers and need to connect. In practice you restrict it to your application and backend hosts on a private network rather than exposing it broadly.
Is it safe to open?
By default Kafka brokers have no authentication or encryption, so anyone who reaches 9092 can read or tamper with your event streams. Enable SASL authentication and TLS, and keep the port on a trusted network. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9092
nmap -p 9092 <target>netstat -ano | findstr :9092
Test-NetConnection <host> -Port 9092lsof -i :9092
nmap -p 9092 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9092 to your device's local IP, internal port 9092, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9092/tcpsudo firewall-cmd --permanent --add-port=9092/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9092 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9092" -Direction Inbound -Protocol TCP -LocalPort 9092 -Action AllowSecurity & risks
Common attacks
- Unauthenticated access to list topics and consume all message data
- Producing or deleting messages and topics to tamper with pipelines
- Information disclosure of streamed business and personal data
- Pivoting via metadata, including the coordinating ZooKeeper on 2181
Hardening
- Enable authentication (SASL) and authorization (ACLs)
- Bind to a private interface and firewall 9092 to trusted hosts only
- Require TLS for client and inter-broker traffic
- Protect the coordinating ZooKeeper (2181) and metadata
- Keep Kafka patched and audit topic access
How to block this port
sudo ufw deny 9092/tcpsudo firewall-cmd --permanent --remove-port=9092/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9092 -j DROPNew-NetFirewallRule -DisplayName "Block 9092" -Direction Inbound -Protocol TCP -LocalPort 9092 -Action Blocknmap snippet
nmap -p9092 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Does Apache Kafka require authentication by default?
- No. By default Kafka brokers accept connections on 9092 with no authentication or encryption, so any client can consume and produce data. Enable SASL authentication, ACLs, and TLS, and firewall the port.
- Why is an exposed Kafka broker dangerous?
- Kafka streams often carry business events and personal data. An open broker lets attackers read every topic, inject or delete messages, and learn cluster metadata including the ZooKeeper on 2181 for further pivoting.