Port 4317: OpenTelemetry (OTLP gRPC)

What uses port 4317

Applications instrumented with OpenTelemetry SDKs export telemetry to a collector or backend (Grafana Alloy, Jaeger, Tempo, Honeycomb, Datadog) using OTLP over gRPC on 4317. OTLP over HTTP uses 4318. Point SDKs at the collector with OTEL_EXPORTER_OTLP_ENDPOINT.

Should port 4317 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Using the HTTP exporter against port 4317, or gRPC against 4318, fails with confusing protocol errors. Match the exporter protocol (OTEL_EXPORTER_OTLP_PROTOCOL) to the port.

Check what is listening on port 4317

sudo ss -ltnp 'sport = :4317'

sudo lsof -nP -iTCP:4317 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 4317 -State Listen
netstat -ano | findstr :4317

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 4317

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:4317 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 4317 -State Listen).OwningProcess

Allow port 4317 from trusted networks only

The examples allow 4317 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 4317 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 4317 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="4317" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "OpenTelemetry (OTLP gRPC) 4317/TCP" -Direction Inbound -Protocol TCP -LocalPort 4317 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 4317 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 4317:4317 would expose the port to the whole network.
docker run -d -p 127.0.0.1:4317:4317 otel/opentelemetry-collector

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 4317 from another machine

nc -zv example.com 4317

Test-NetConnection example.com -Port 4317

Related ports

• Port 4318 (OpenTelemetry (OTLP HTTP)): used by OpenTelemetry to send traces, metrics and logs over HTTP (OTLP).
• Port 9090 (Prometheus): the default port of the Prometheus server.

More monitoring and logging ports

161 (SNMP) , 162 (SNMP traps) , 514 (Syslog) , 5601 (Kibana) , 9093 (Alertmanager / Kafka controller) , 9100 (Node exporter / printing) . See all ports in the port lookup.

Sources

• IANA port registry: 4317

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions