Port 9200 Elasticsearch – Free, Online, Private

What listens on 9200

The registry assigns 9200 to wap-wsp. The description is a WAP connectionless session service, and the rows exist for TCP and UDP. The process on a search cluster is Elasticsearch, which binds an HTTP API to 9200 by default and speaks JSON over HTTP. That is not WAP. IANA did not assign the number to Elasticsearch. Port 9300 is the older transport port used between nodes and is not wap-wsp either. Current versions can do HTTP between nodes and still leave 9200 as the API clients use. A request to http://host:9200/ returns cluster JSON when the API is open. It does not speak the WAP protocol.

The IANA service name is wap-wsp: WAP connectionless session service. The practical transport is TCP. The checks below use TCP. IANA may also have a UDP row for 9200. The service described here is the TCP one. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 9200

Service notes for port 9200: the IANA name is wap-wsp (WAP connectionless session service), and the program people mean is Elasticsearch. TCP 9200 is the IANA wap-wsp port, the WAP connectionless session service. Elasticsearch's HTTP API uses 9200 by convention. The transport port 9300 is not this assignment. An Elasticsearch on a public 9200 with security disabled is a data store on the internet. Current versions enable security by default. Old charts did not. Bind the HTTP port to the application network, require authentication, and turn on TLS for anything outside a locked segment. A cluster that is reachable and allows the elastic user with a default password will be ransomed. Index names are not access control. Snapshots to an open bucket are a second copy of the same mistake. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 9200, you are on the wrong page.

People open 9200 and forget that a multi-node cluster may still need 9300, so the API answers and the cluster never forms. Another trap is a client using HTTPS against a cleartext 9200. Another is a load balancer health check that marks a node up because TCP connects, while the node is red and should not take traffic. Use the cluster health endpoint. Another is a scanner label of wap-wsp that sends an operator looking for a phone gateway. The process name is java or elasticsearch. Another is IPv6 left unbound.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 9200 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. The Elasticsearch process should own TCP 9200. A GET of / from an allowed client returns JSON with a cluster name and a version. A reset means the HTTP port is not bound. A 401 means security is on, which is what you want.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• The IANA name is wap-wsp. Elasticsearch is convention.
• 9300 is the transport port in older clusters, not the HTTP API.
• A TCP connect is a poor health check. Read cluster health.
• UDP 9200 is the WAP registration, not the search API.

Linuxsudo ss -lptn 'sport = :9200'
sudo lsof -nP -iTCP:9200 -sTCP:LISTEN

macOSsudo lsof -nP -iTCP:9200 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.9200[^0-9]'

Windowsnetstat -ano | findstr :9200
Get-NetTCPConnection -LocalPort 9200

Remotenc -vz host 9200