Port 2181 ZooKeeper – Free, Online, Private

What listens on 2181

The registry assigns 2181 to eforward, on TCP and UDP. The process almost everyone has on this port is the ZooKeeper client listener. ZooKeeper's default clientPort is 2181. The quorum ports, where servers talk to each other, default to 2888 and 3888 and are not registered as eforward either. A Kafka cluster that still uses ZooKeeper will have 2181 on the ZooKeeper hosts and 9092 on the brokers. Those are different machines or different sockets. Clients of ZooKeeper speak a binary protocol. An HTTP probe will not get a status page. AdminServer, if you turned it on, is a different port, often 8080.

The IANA service name is eforward: eforward. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 2181. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 2181

Service notes for port 2181: the IANA name is eforward (eforward), and the program people mean is ZooKeeper. TCP 2181 is the IANA eforward port. Apache ZooKeeper's client port is 2181 by convention, and that is not the registered service name. ZooKeeper without authentication lets anyone who can open 2181 read and write the tree, including Kafka ACLs and cluster membership if those live there. Do not put 2181 on a public address. Use a security group that allows only the brokers and the operators. SASL and TLS exist for the client port. Turning them on is a configuration change on every client, and a half-migrated cluster will lose quorum members or clients. The four-letter words, if left enabled, are a small information leak. Disable the ones you do not need. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 2181, you are on the wrong page.

Operators open 2181 and forget 2888 and 3888 between the ensemble members, so a three-node cluster never elects a leader. The client port can look open on each node the whole time. Another trap is a client connecting to a follower that is up while the ensemble has no quorum. The TCP connection succeeds and the session does not. Another is Docker publishing 2181 on the host while the myid file inside the container is wrong. Another is confusing this port with etcd's 2379. Both are consensus stores. They are not the same protocol.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 2181 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. The process is usually java, running QuorumPeerMain or a distribution's wrapper. ruok and srvr are the old four-letter checks, and they only work if you enabled them. A TCP connect is not a quorum.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• IANA says eforward. ZooKeeper's use is convention, not the registered name.
• 2888 and 3888 are the usual peer ports and are not 2181.
• UDP 2181 is in the registry. ZooKeeper clients use TCP.
• An open client port with no quorum still fails sessions.

Linuxsudo ss -lptn 'sport = :2181'
sudo lsof -nP -iTCP:2181 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:2181 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.2181[^0-9]'

Windowsnetstat -ano | findstr :2181
Get-NetTCPConnection -LocalPort 2181

Remotenc -vz host 2181