Port 9092 Kafka – Free, Online, Private

What listens on 9092

The registry assigns 9092 to XmlIpcRegSvc, Xml-Ipc Server Reg, on TCP and UDP. The process people mean is a Kafka broker. Kafka's default listeners are PLAINTEXT://:9092. The protocol is Kafka's binary protocol, not XML and not HTTP. A client bootstrap server of host:9092 uses this convention. TLS and SASL listeners are extra ports or the same port with a different security protocol, depending on the broker config. 9093 is a common TLS choice and is not a separate well-known assignment you can rely on. ZooKeeper, if the cluster still has it, is 2181. KRaft mode does not need 2181. UDP 9092 is in the registry and is not a Kafka client transport.

The IANA service name is XmlIpcRegSvc: Xml-Ipc Server Reg. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 9092. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 9092

Service notes for port 9092: the IANA name is XmlIpcRegSvc (Xml-Ipc Server Reg), and the program people mean is Kafka. TCP 9092 is the IANA XmlIpcRegSvc port, Xml-Ipc Server Reg. Apache Kafka brokers use 9092 by convention, and that is not the registered service name. PLAINTEXT on a reachable 9092 is an unauthenticated broker. Bind it to the application network, or turn on SASL and TLS and set advertised.listeners to a name clients can resolve. advertised.listeners set to an internal hostname is the bug that makes a port look open and a client fail after the first metadata response, because the broker tells the client to reconnect somewhere it cannot reach. ACLs belong on the topics. Network policy is not a topic ACL. Do not publish a broker on the internet. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 9092, you are on the wrong page.

The metadata redirect is the classic failure. nc -vz host 9092 succeeds, and the producer then times out on the advertised address. Read the listener config. Another trap is a security group between brokers that allows 9092 and blocks the controller or inter-broker listener. Clients produce, replication lags. Another is a client using 9092 against a TLS listener. The first bytes do not match and the error is a frame parse, not a refused connection. Another is confusing this port with the Kafka REST proxy or the schema registry, which are HTTP on their own ports.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 9092 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. The Kafka process should own TCP 9092 if PLAINTEXT is enabled. From a client network, a metadata request is the test. A TCP connect is only the first step, and it misses the advertised-listener bug.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• The IANA name is XmlIpcRegSvc. Kafka's use is convention.
• advertised.listeners can point the client at a different address after a successful connect.
• 2181 is ZooKeeper, not the broker.
• UDP 9092 is not the client protocol.

Linuxsudo ss -lptn 'sport = :9092'
sudo lsof -nP -iTCP:9092 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:9092 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.9092[^0-9]'

Windowsnetstat -ano | findstr :9092
Get-NetTCPConnection -LocalPort 9092

Remotenc -vz host 9092