Port 4369 – Erlang Port Mapper (EPMD)

TCP

Port 4369 is the Erlang Port Mapper Daemon (EPMD) – a name service for Erlang and Elixir nodes. RabbitMQ depends on EPMD for cluster node discovery. If port 4369 is blocked between RabbitMQ nodes, cluster formation fails. EPMD should be firewalled from public access – it exposes information about all running Erlang nodes.

Port Number

4369

Protocol

TCP

Service

Erlang Port Mapper Daemon

Range

IANA Registered (1024–49151)

Description

EPMD runs as a daemon and maps Erlang node names to dynamic TCP ports. When a RabbitMQ node starts, it registers with EPMD. Other nodes query EPMD to discover what port a peer is listening on. Blocking port 4369 breaks RabbitMQ clustering. In containerized environments, EPMD must be accessible between all RabbitMQ container instances.

Security risks

1CVE-2018-11462 (CouchDB/Erlang): Remote code execution via EPMD – attacker connects to EPMD, discovers node ports, then exploits Erlang distribution protocol (no auth by default) to execute arbitrary code
2Erlang cookie authentication is a shared-secret model – all nodes in a cluster share the same cookie (~/.erlang.cookie). If leaked or default, any Erlang node can join the cluster
3EPMD exposes all running Erlang node names and their dynamic ports – information disclosure useful for further attacks
4Default Erlang distribution uses no encryption – cookie and all data transmitted in cleartext between nodes
5RabbitMQ clusters: compromised EPMD access leads to full queue data access, message injection, and cluster disruption

Firewall guidance

Port 4369 MUST be open between all RabbitMQ/Erlang cluster nodes but MUST be blocked from everything else. Use iptables/security groups to allow only cluster peer IPs. Also restrict the Erlang distribution port range (inet_dist_listen_min/max in rabbitmq.conf). For single-node RabbitMQ, block 4369 from all external access.

Diagnosis commands

List all Erlang nodes registered with local EPMD (shows node names + dynamic ports)

shell

epmd -names

Query remote EPMD to discover registered nodes (should fail if firewalled)

shell

epmd -port 4369 -names -address 10.0.1.5

Show RabbitMQ cluster members and their connectivity (requires running node)

shell

rabbitmqctl cluster_status

Verify EPMD is listening and which process owns it

shell

ss -tlnp | grep 4369

Usage examples

Port 4369 – Erlang Port Mapper (EPMD)

shell

epmd -names
curl http://localhost:15672/api/nodes

Common services on this port

RabbitMQCouchDBRiakEjabberdVerneMQEMQ XElixir applications

Related ports

5672

AMQP (RabbitMQ messaging)

15672

RabbitMQ Management UI

25672

Erlang distribution (RabbitMQ inter-node)

4370

EPMD TLS (custom configurations)

History

EPMD was created as part of Erlang/OTP (Open Telecom Platform) at Ericsson in the late 1980s. Port 4369 was registered with IANA for Erlang distribution. EPMD is a simple name server that maps symbolic node names (rabbit@hostname) to TCP ports. When RabbitMQ starts, it registers with EPMD and gets a dynamic port for the distribution protocol. Modern alternatives (Kubernetes DNS-based peer discovery) can eliminate EPMD in container environments.

FAQ

Can I run RabbitMQ without EPMD?

Since Erlang/OTP 23.1 and RabbitMQ 3.9+, you can use the 'epmd-less' peer discovery by setting RABBITMQ_DIST_PORT to a fixed port and using -proto_dist inet_tls. However, this is not widely documented and most deployments still use EPMD. In Kubernetes, the rabbitmq-peer-discovery-k8s plugin uses DNS for discovery but still requires EPMD for the actual distribution connection.

How do I secure the Erlang cookie?

Set a strong random cookie: head -c 64 /dev/urandom | base64 | tr -d '\n' > /var/lib/rabbitmq/.erlang.cookie && chmod 400 /var/lib/rabbitmq/.erlang.cookie. Never use the default cookie. Ensure all cluster nodes share the same cookie value (deploy via secrets management, not in config files). Enable Erlang distribution TLS (inet_dist_use_interface, server_dist_tls in vm.args) for encryption.