Port 2379 etcd client – Free, Online, Private

What listens on 2379

Port 2379 is the etcd client port. The IANA name is etcd-client, etcd client communication, assigned in 2014. Clients, including kube-apiserver in a typical cluster, dial 2379 and speak the etcd gRPC and JSON API. Port 2380 is etcd-server, the peer port, and it is a different assignment. Opening 2379 between API servers and etcd, and opening 2380 only among etcd members, is the split you want. UDP 2379 is reserved. A process on 2379 that is not etcd is something else using a memorable number. Kubernetes' own API is 6443, which is also not the IANA name for that use.

The IANA service name is etcd-client: etcd client communication. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 2379. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 2379

Service notes for port 2379: the IANA name is etcd-client (etcd client communication), and the program people mean is etcd client. TCP 2379 is the IANA etcd-client port. etcd serves its client API here. Peer traffic is 2380, etcd-server, not this port. UDP 2379 is reserved. etcd holds Kubernetes secrets if this cluster is a Kubernetes cluster. An unauthenticated 2379 is a full read of those secrets. Current etcd can require mutual TLS. Turn it on, and do not publish the port past the control-plane network. A node that only runs workloads does not need a route to 2379. Compact and snapshot the database, because a full disk stops the cluster even when the port is fine. Certificates for peer traffic and client traffic are different files in most installers. Mixing them produces a handshake error that looks like a firewall. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 2379, you are on the wrong page.

The usual outage is a security group that allows 2379 and forgets 2380, so a new member never joins and the client port on the survivor still answers. Another is a client using http:// against an HTTPS listener. Another is an old member IP in the advertise URL after a rebuild, so peers try a dead address and the port on the new host is innocent. Another is testing with nc and treating a TCP connect as a healthy raft group. etcdctl endpoint health is the test that asks the API.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 2379 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. etcd should own TCP 2379 on the control-plane address, not on a public address. Peer connections belong on 2380. From a node, a timeout on 2379 is a route or a policy. A TLS error is a certificate.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• 2379 is the client port. 2380 is the peer port, IANA name etcd-server.
• UDP 2379 is reserved.
• Unauthenticated read of 2379 is a secret dump on a Kubernetes control plane.
• A listening client port does not prove the member has a leader.

Linuxsudo ss -lptn 'sport = :2379'
sudo lsof -nP -iTCP:2379 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:2379 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.2379[^0-9]'

Windowsnetstat -ano | findstr :2379
Get-NetTCPConnection -LocalPort 2379

Remotenc -vz host 2379