Port reference
Port 9100 (TCP) – Printer JetDirect / node_exporter
Raw TCP printing (HP JetDirect/PDL) on printers; also Prometheus node_exporter host metrics.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on networked printers for raw printing, and on hosts running node_exporter. Both are frequently left unauthenticated on the LAN.
What is port 9100 used for?
Port 9100 has two common uses. On network printers it is the raw TCP printing port (HP JetDirect / PDL), where the device accepts print jobs sent directly as a byte stream, which is how most operating systems send "raw" or "socket" print jobs. On servers, the same port number is used by Prometheus node_exporter to expose host metrics (CPU, memory, disk) for monitoring. Which one you have depends entirely on the device.
When would you open it?
Open or forward 9100 on a printer when computers or a print server on your network need to send jobs to it directly. For node_exporter, you open it so your Prometheus server can scrape the host's metrics. In both cases you keep it within your LAN or a management network, not the public internet.
Is it safe to open?
Raw printing has no authentication, and an exposed node_exporter leaks host details, so 9100 should stay on trusted networks only. Restrict it to your print server or monitoring system. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9100
nmap -p 9100 <target>netstat -ano | findstr :9100
Test-NetConnection <host> -Port 9100lsof -i :9100
nmap -p 9100 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9100 to your device's local IP, internal port 9100, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9100/tcpsudo firewall-cmd --permanent --add-port=9100/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9100 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9100" -Direction Inbound -Protocol TCP -LocalPort 9100 -Action AllowSecurity & risks
Common attacks
- Raw print job injection and printer DoS
- PJL/PostScript abuse to read or write the printer file system (PRET)
- Stealing queued documents and changing device settings
- Exposed node_exporter metrics revealing host details for recon
Hardening
- Restrict 9100 to print servers / management VLAN; block at the perimeter
- Disable PJL/PostScript file access and update printer firmware
- Require authentication for printer admin and disable raw 9100 if unused
- Bind node_exporter to localhost or scrape over a private network
- Front node_exporter with auth/TLS and IP-allowlist scrapers
How to block this port
sudo ufw deny 9100/tcpsudo firewall-cmd --permanent --remove-port=9100/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9100 -j DROPNew-NetFirewallRule -DisplayName "Block 9100" -Direction Inbound -Protocol TCP -LocalPort 9100 -Action Blocknmap snippet
nmap -p9100 --script banner,pjl-ready-message <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 9100 used for?
- It is the raw TCP printing port (HP JetDirect/PDL) that printers listen on to receive print jobs directly. The same port number is also used by Prometheus node_exporter to expose host metrics.
- Why is port 9100 risky?
- Raw printing has no authentication, so tools like PRET can abuse PJL/PostScript to read queued documents or the printer file system. If node_exporter runs here, exposed metrics leak host details. Restrict 9100 to trusted networks.