Port 9092: Apache Kafka

What uses port 9092

Kafka clients connect to brokers on 9092 and receive metadata telling them which broker address to use for each partition. Redpanda and Confluent Cloud also use 9092. In KRaft mode, controllers commonly use 9093.

Should port 9092 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Clients connect but then fail with “Connection to node -1 could not be established” or connect to the wrong host? The broker’s advertised.listeners must be an address clients can reach, which differs inside and outside Docker.

Check what is listening on port 9092

sudo ss -ltnp 'sport = :9092'

sudo lsof -nP -iTCP:9092 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 9092 -State Listen
netstat -ano | findstr :9092

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 9092

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:9092 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 9092 -State Listen).OwningProcess

Allow port 9092 from trusted networks only

The examples allow 9092 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 9092 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 9092 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="9092" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Apache Kafka 9092/TCP" -Direction Inbound -Protocol TCP -LocalPort 9092 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 9092 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 9092:9092 would expose the port to the whole network.
docker run -d -p 127.0.0.1:9092:9092 apache/kafka

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 9092 from another machine

nc -zv example.com 9092

Test-NetConnection example.com -Port 9092

Related ports

• Port 9093 (Alertmanager / Kafka controller): used by Prometheus Alertmanager and often by Kafka KRaft controllers.
• Port 5672 (AMQP (RabbitMQ)): the AMQP port used by RabbitMQ and other message brokers.
• Port 4222 (NATS): the client port of the NATS messaging system.

More messaging and queues ports

1883 (MQTT) , 4369 (Erlang Port Mapper (epmd)) , 5060 (SIP) , 5222 (XMPP client) , 8883 (MQTT over TLS) , 15672 (RabbitMQ management) . See all ports in the port lookup.

Sources

• IANA port registry: 9092

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions