Port 7000 (AirPlay (macOS) / Cassandra): Uses and Security

What uses port 7000

On macOS 12 and later, the AirPlay Receiver listens on ports 5000 and 7000, so development servers configured for those ports fail to start. Apache Cassandra uses 7000 for communication between nodes (7001 with TLS).

Should port 7000 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 7000

Linux

sudo ss -ltnp 'sport = :7000'

macOS

sudo lsof -nP -iTCP:7000 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 7000 -State Listen
netstat -ano | findstr :7000

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 7000

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:7000 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 7000 -State Listen).OwningProcess

Allow port 7000 from trusted networks only

The examples allow 7000 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 7000 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 7000 proto tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="7000" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "AirPlay (macOS) / Cassandra 7000/TCP" -Direction Inbound -Protocol TCP -LocalPort 7000 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 7000 from another machine

macOS / Linux

nc -zv example.com 7000

Windows (PowerShell)

Test-NetConnection example.com -Port 7000

Related ports

Port 5000 (Flask / development servers): the default port of the Flask development server and several other tools.
Port 9042 (Cassandra / ScyllaDB): the CQL client port of Apache Cassandra and ScyllaDB.

More other ports

25565 (Minecraft) . See all ports in the port lookup.

Sources

IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 7000 used for?

Port 7000 is used by the macOS AirPlay Receiver and by Cassandra inter-node traffic. On macOS 12 and later, the AirPlay Receiver listens on ports 5000 and 7000, so development servers configured for those ports fail to start. Apache Cassandra uses 7000 for communication between nodes (7001 with TLS).

Is it safe to open port 7000?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 7000 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :7000'" on Linux or "sudo lsof -nP -i :7000" on macOS. From another machine, run "nc -zv host 7000" or, on Windows, "Test-NetConnection host -Port 7000". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.