Skip to main content
protocols.pageprotocols.page
2181

Port 2181 – Apache ZooKeeper

TCP

Port 2181 is the Apache ZooKeeper client connection port. Kafka brokers, Hadoop, HBase, and many distributed systems use ZooKeeper on port 2181 for distributed coordination – leader election, configuration management, and distributed locking. ZooKeeper 3.5+ introduced a built-in AdminServer on port 8080.

Port Number

2181

Protocol

TCP

Service

ZooKeeper Client Port

Range

IANA Registered (1024–49151)

Description

ZooKeeper listens on port 2181 for client connections. It provides a centralized, highly-available coordination service for distributed systems. Kafka 2.8+ supports KRaft mode (removing ZooKeeper), but many production Kafka clusters still rely on ZooKeeper on port 2181. ZooKeeper's peer ports 2888 (follower) and 3888 (leader election) are also needed in clusters.

Security risks

  • 1No authentication by default: ZooKeeper ships without authentication. Any client that reaches port 2181 can read and write all znodes – including Kafka broker configs, HBase region assignments, and Hadoop cluster state. Enable SASL authentication (Kerberos or DIGEST-MD5).
  • 2Four-letter-word commands: ZooKeeper responds to 4-letter commands (ruok, stat, dump, envi) on port 2181 without authentication. These leak cluster topology, connection counts, and environment variables. Disable with: 4lw.commands.whitelist=ruok (ZooKeeper 3.5+).
  • 3Kafka credential exposure: Kafka stores SASL credentials and ACLs in ZooKeeper znodes. Unauthenticated ZooKeeper access means reading all Kafka user passwords. Migrate to KRaft mode (Kafka 3.3+) to eliminate ZooKeeper entirely.

Firewall guidance

Restrict port 2181 to only the services that need coordination (Kafka brokers, HBase RegionServers, Solr nodes). Never expose to the internet. In Kubernetes, use a headless Service accessible only within the namespace. Migrate Kafka clusters to KRaft mode to eliminate the ZooKeeper dependency entirely.

Diagnosis commands

Basic health check – should return 'imok'

shell
echo ruok | nc host 2181

Show ZooKeeper node stats (connections, latency, mode)

shell
echo stat | nc host 2181

List root znodes – shows what systems are using this ZooKeeper

shell
zkCli.sh -server host:2181 ls /

Usage examples

Port 2181 – Apache ZooKeeper
shell
zkCli.sh -server localhost:2181
echo ruok | nc localhost:2181
kafka-topics.sh --zookeeper localhost:2181 --list

Common services on this port

Apache ZooKeeperApache Kafka (pre-KRaft)Apache HBaseApache Hadoop HDFSApache SolrClickHouse Keeper

Related ports

2888

ZooKeeper follower port

3888

ZooKeeper leader election

9092

Kafka broker (depends on ZK)

History

ZooKeeper was created at Yahoo Research and became an Apache top-level project in 2010. It was essential for Kafka, HBase, and Hadoop coordination. Kafka's KRaft mode (2022) began the deprecation of ZooKeeper for Kafka, with full removal targeted for Kafka 4.0.

FAQ

Is ZooKeeper still needed for Kafka?

Kafka 3.3+ supports KRaft (Kafka Raft) mode which eliminates ZooKeeper. KRaft is production-ready since Kafka 3.5. New clusters should use KRaft. Existing clusters can migrate via kafka-metadata.sh. ZooKeeper mode will be removed in Kafka 4.0.