Port 7000 – Cassandra Inter-node

TCP

Port 7000 is Apache Cassandra's inter-node communication port for cluster gossip and data replication. Port 7001 is used when TLS is enabled for inter-node communication. These ports must be accessible between all Cassandra nodes in the cluster but should be blocked from client applications and the public internet.

Port Number

7000

Protocol

TCP

Service

Cassandra Gossip / Inter-node

Range

IANA Registered (1024–49151)

Description

Cassandra uses a gossip protocol on port 7000 for node discovery, ring membership, and replication coordination. Every node in a Cassandra cluster must be able to connect to every other node on port 7000. Port 7001 replaces 7000 when ssl_storage_port is configured. Client applications connect via CQL on port 9042, not via port 7000.

Security risks

1CVE-2020-17516: Apache Cassandra internode messaging allows remote code execution – specially crafted messages on port 7000 execute arbitrary code (fixed 3.11.10, 4.0-beta4)
2No encryption by default: inter-node gossip and streaming on port 7000 transmits all replicated data in cleartext – network sniffers see every write to any replica
3Rogue node injection: without internode authentication (server_encryption_options in cassandra.yaml), any host reaching port 7000 can join the cluster, receive data replicas, and disrupt consistency
4Gossip protocol information leak: node state (token ranges, load, datacenter/rack, schema version, Cassandra version) shared freely with any connected peer
5Streaming port abuse: during node repair/bootstrap, full SSTables are streamed over port 7000 – a rogue node receives complete copies of data

Firewall guidance

Port 7000 must be open ONLY between Cassandra cluster nodes (same datacenter and cross-DC replication). Block from all client machines, CI/CD, and internet. Enable internode encryption: server_encryption_options.internode_encryption: all + require_client_auth: true in cassandra.yaml. Use port 7001 (TLS) and disable 7000 entirely in production.

Diagnosis commands

Show gossip state for all known nodes (verify only expected peers)

shell

nodetool gossipinfo | head -30

Show active streaming operations (repair, bootstrap data transfers on port 7000)

shell

nodetool netstats

Check if internode encryption is enabled (should be: internode_encryption: all)

shell

grep 'server_encryption' /etc/cassandra/cassandra.yaml

Verify TLS on internode port 7001 (if using encrypted gossip)

shell

openssl s_client -connect peer-node:7001 </dev/null 2>&1 | grep 'Verify'

Usage examples

Port 7000 – Cassandra Inter-node

shell

nodetool ring
nodetool gossipinfo
netstat -tlnp | grep 7000

Common services on this port

Apache CassandraDataStax EnterpriseScyllaDBAmazon Keyspaces (managed, no port exposure)

Related ports

7001

Cassandra inter-node TLS (encrypted gossip)

9042

CQL native protocol (client-facing)

9160

Thrift API (deprecated)

7199

JMX (nodetool management)

History

Cassandra's gossip protocol was inspired by Amazon's Dynamo paper (2007). Port 7000 was chosen when Cassandra was open-sourced by Facebook in 2008. The gossip protocol uses port 7000 for both gossip state exchange and data streaming (repair, bootstrap). Port 7001 was added later for TLS-encrypted internode communication. Cassandra 4.0 (2021) added full internode messaging encryption and the ability to audit internode traffic.

FAQ

Should I use port 7000 or 7001 in production?

Use port 7001 (TLS) exclusively. In cassandra.yaml: server_encryption_options: internode_encryption: all, keystore: /path/keystore.jks, truststore: /path/truststore.jks, require_client_auth: true. Then firewall port 7000 closed. This encrypts all inter-node traffic (gossip + streaming) and authenticates peers via certificates. Performance overhead is <5% on modern hardware with AES-NI.

What happens if port 7000 is blocked between Cassandra nodes?

Gossip failure: nodes mark each other as DOWN after phi_convict_threshold is exceeded (~8 seconds default). Reads/writes fail with NoHostAvailableException if RF nodes are unreachable. Repairs fail mid-stream. Eventually, node is removed from the ring (auto_bootstrap). Recovery: unblock the port, node re-gossips and rejoins automatically. Data inconsistency requires nodetool repair after prolonged partitions.