Port 27017 MongoDB – Free, Online, Private

What listens on 27017

Port 27017 is MongoDB. The IANA name is mongodb, Mongo database system, assigned to MongoDB, Inc. in February 2019. A mongod listens here by default and speaks the MongoDB wire protocol over TCP. TLS is a server parameter, not the default on old builds. A replica set uses the same port on each member unless you change it. The client receives a hello response that lists the members, and then it connects to the primary's advertised address. That second connection is the one a firewall often drops. UDP 27017 is reserved. Ports 27018 and 27019 show up as extra mongod ports in sharded clusters and are not this assignment. The registry notes known use on those unassigned numbers.

The IANA service name is mongodb: Mongo database system. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 27017. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 27017

Service notes for port 27017: the IANA name is mongodb (Mongo database system), and the program people mean is MongoDB. TCP 27017 is the IANA mongodb port, assigned in 2019. The wire protocol is MongoDB's, and it is not encrypted unless you enable TLS. UDP 27017 is reserved. A mongod with no authorization, bound to all interfaces, is a database on the network. Enable access control, create a user, and bind to the application network. Turn on TLS if the path is shared, and set the client to verify the certificate. Do not publish 27017 to the internet. The admin database and a role of root are not the application account. A backup user is still a user that can read everything you let it read. Authorization off 'until the app is ready' is how these servers get ransomwared. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 27017, you are on the wrong page.

The TCP handshake to the seed host succeeds, and the driver then times out connecting to the primary's advertised hostname, which is a container name or a private address the client cannot resolve. Fix the advertised host, not only the security group of the seed. Another trap is a localhost exception: the first user can be created from localhost without credentials, and a remote client still cannot connect. That is the feature working. Another is a TLS-required server and a driver that speaks cleartext. The port looks open and the first message fails. Another is an IPv6 bind. Another is a shard on 27018 that nobody opened.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 27017 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. mongod should own TCP 27017 on the address clients use. A hello or a ping from the application network is the test. A connection from the database host to itself does not prove the security group. A reset means nothing is listening.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• UDP 27017 is reserved. Clients use TCP.
• The driver follows the member list. One open port is not the whole replica set.
• 27018 and 27019 are not the 27017 assignment.
• No authorization and a public bind is a public database.

Linuxsudo ss -lptn 'sport = :27017'
sudo lsof -nP -iTCP:27017 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:27017 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.27017[^0-9]'

Windowsnetstat -ano | findstr :27017
Get-NetTCPConnection -LocalPort 27017

Remotenc -vz host 27017