Skip to main content
protocols.pageprotocols.page
16686

Port 16686 – Jaeger UI

TCP

Port 16686 is the Jaeger distributed tracing UI port. Jaeger is an open-source distributed tracing system (CNCF project) compatible with OpenTelemetry. The web UI at port 16686 shows trace timelines, service dependency graphs, and span details. Jaeger collector receives traces on port 14268 (HTTP) or 4317 (OTLP/gRPC).

Port Number

16686

Protocol

TCP

Service

Jaeger Distributed Tracing UI

Range

IANA Registered (1024–49151)

Description

Jaeger provides distributed request tracing across microservices. Port 16686 serves the query UI and API. Applications send trace data to the Jaeger collector (not directly to 16686). In Kubernetes, Jaeger is commonly deployed as part of an observability stack alongside Prometheus (9090) and Grafana (3000). Port 16686 should only be accessible internally.

Security risks

  • 1No authentication by default – Jaeger UI and Query API expose all distributed traces including request headers, database queries, and inter-service payloads
  • 2Trace data often contains sensitive information: authorization headers, SQL queries with parameters, user IDs, internal service topology, and error messages with stack traces
  • 3Query API allows enumeration of all services, operations, and trace timelines – valuable reconnaissance for lateral movement in microservice architectures
  • 4gRPC query endpoint (port 16685) also lacks auth and can be scripted for bulk trace exfiltration
  • 5SSRF via Jaeger dependencies endpoint if an attacker can influence trace spans (crafted service names can probe internal networks via dependency graph visualization)

Firewall guidance

Port 16686 should only be accessible from internal admin networks. Use kubectl port-forward for ad-hoc access. In production, deploy behind an authenticating reverse proxy (oauth2-proxy with your IdP). The collector ports (14268, 14250, 4317) should only accept connections from application pods/instances, not from the internet.

Diagnosis commands

List all traced services (shows your service topology)

shell
curl -s http://localhost:16686/api/services | jq .data

Fetch recent traces for a service and show span counts

shell
curl -s 'http://localhost:16686/api/traces?service=my-svc&limit=5' | jq '.data[].spans | length'

Service dependency graph (which services call which)

shell
curl -s http://localhost:16686/api/dependencies?endTs=$(date +%s)000 | jq '.data'

Secure access to Jaeger UI via kubectl port-forward

shell
kubectl port-forward svc/jaeger-query 16686:16686 -n observability

Usage examples

Port 16686 – Jaeger UI
shell
curl http://localhost:16686/api/services
kubectl port-forward svc/jaeger-query 16686:16686

Common services on this port

JaegerJaeger All-in-OneTempo (Grafana)SigNozZipkin

Related ports

14268

Jaeger Collector HTTP (direct span submission)

14250

Jaeger Collector gRPC (agent → collector)

4317

OTLP gRPC (OpenTelemetry Collector)

4318

OTLP HTTP (OpenTelemetry Collector)

6831

Jaeger Agent (compact thrift over UDP)

9411

Zipkin compatible endpoint

History

Jaeger was created at Uber in 2015, inspired by Google's Dapper paper and Twitter's Zipkin. Open-sourced in 2017, it became a CNCF project and graduated in 2019. Port 16686 was chosen arbitrarily. Originally Jaeger used its own client libraries and Thrift protocol; since 2022, the project recommends OpenTelemetry SDKs instead. Jaeger v2 (2024) is built on the OpenTelemetry Collector framework.

FAQ

Jaeger vs Tempo vs Zipkin?

Jaeger: mature, full-featured UI, supports Cassandra/Elasticsearch/Kafka backends, CNCF graduated. Tempo (Grafana): no index needed (object storage only), cheapest at scale, integrates with Grafana natively, uses TraceQL query language. Zipkin: simple, Java-based, good for small deployments, less active development. All three support OpenTelemetry OTLP ingestion.

How do I add authentication to Jaeger?

Jaeger has no built-in auth. The standard approach: (1) deploy oauth2-proxy as sidecar or ingress middleware, (2) configure it against your IdP (Okta, Keycloak, Google), (3) proxy 16686 through it. In Kubernetes: use an Ingress with nginx.ingress.kubernetes.io/auth-url annotation pointing to oauth2-proxy. The Jaeger Operator supports injecting auth sidecars via CR annotations.

What is the difference between ports 14268, 14250, and 4317?

14268: Jaeger Collector HTTP endpoint (legacy, accepts Thrift spans directly from SDKs). 14250: Jaeger Collector gRPC (Jaeger agents forward spans here). 4317: OTLP gRPC (the modern standard – OpenTelemetry SDKs send here). For new deployments, use 4317 (OTLP) exclusively. 14268/14250 exist for backward compatibility with Jaeger-native clients.