Skip to main content
protocols.pageprotocols.page
9092

Port 9092 – Apache Kafka

TCP

Port 9092 is the default Apache Kafka broker port for plaintext client connections. Kafka also uses port 9093 for TLS (SSL) connections and port 9094 for SASL+TLS. ZooKeeper-based Kafka clusters use port 2181 for coordination. KRaft mode (Kafka 3.3+) eliminates ZooKeeper. Port 9092 traffic should be restricted to trusted application servers.

Port Number

9092

Protocol

TCP

Service

Kafka Broker

Range

IANA Registered (1024–49151)

Description

Kafka brokers listen on port 9092 for producer and consumer connections using the Kafka wire protocol. The broker configuration (listeners and advertised.listeners) controls which interfaces and ports are exposed. Multi-listener configurations are common: plaintext (9092) for internal services, TLS (9093) for external clients, SASL_SSL (9094) for authenticated+encrypted connections.

Security risks

  • 1No authentication by default: Kafka's PLAINTEXT listener on 9092 accepts connections from any client without credentials. Any host that can reach 9092 can produce messages (data injection), consume messages (data theft), and create/delete topics. Configure SASL_SSL or mTLS for all non-localhost listeners.
  • 2Data exfiltration via consumer groups: an unauthorized consumer joining a group reads all messages from subscribed topics. Without ACLs, there is no per-topic access control. Enable kafka-acls: kafka-acls.sh --authorizer-properties zookeeper.connect=localhost:2181 --add --allow-principal User:app --operation Read --topic sensitive.
  • 3Broker-to-broker plaintext: inter-broker replication on port 9092 sends topic data in cleartext between nodes. Configure security.inter.broker.protocol=SSL and listeners=SSL://0.0.0.0:9093 for encrypted replication.
  • 4Metadata exposure: connecting to port 9092 returns full cluster metadata including all broker IPs, topic names, and partition counts – useful reconnaissance for an attacker mapping your infrastructure.

Firewall guidance

Port 9092 (PLAINTEXT) should only be accessible from the same private network/VPC as application servers. For cross-network access, use 9093 (SSL) or 9094 (SASL_SSL) with proper certificates and credentials. Block 9092 from the internet entirely. In Kubernetes, use a ClusterIP Service for internal clients and LoadBalancer with TLS for external.

Diagnosis commands

Test connectivity and show broker API versions

shell
kafka-broker-api-versions.sh --bootstrap-server host:9092

List all consumer groups (check for unauthorized consumers)

shell
kafka-consumer-groups.sh --bootstrap-server host:9092 --list

Show topic partitions, replicas, and ISR status

shell
kafka-topics.sh --bootstrap-server host:9092 --describe --topic mytopic

Detect Kafka broker remotely (should fail if properly firewalled)

shell
nmap -sV -p 9092 target

Usage examples

Port 9092 – Apache Kafka
shell
kafka-topics.sh --bootstrap-server localhost:9092 --list
kafka-console-producer.sh --broker-list localhost:9092 --topic test
kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic test --from-beginning

Common services on this port

Apache KafkaConfluent PlatformAmazon MSKAzure Event Hubs (Kafka API)RedpandaStrimzi (Kubernetes)

Related ports

9093

Kafka SSL/TLS

9094

Kafka SASL_SSL

2181

ZooKeeper (Kafka coordination)

History

Kafka was created at LinkedIn by Jay Kreps, Neha Narkhede, and Jun Rao in 2010, open-sourced in 2011. Named after Franz Kafka. Port 9092 was the arbitrary default. Confluent (founded 2014) commercializes it. KRaft mode (2022) removes the ZooKeeper dependency. Redpanda (2020) provides a Kafka-compatible alternative in C++.

FAQ

Kafka vs RabbitMQ?

Kafka: durable event log, consumer groups read at their own pace, replay capability, high throughput (millions msg/sec), best for event streaming and ETL. RabbitMQ: traditional message broker, per-message acknowledgment, complex routing (exchanges/bindings), best for task queues and request-reply patterns. Kafka retains messages; RabbitMQ deletes after consumption.

Should I use port 9092 or 9093 in production?

Use 9093 (SSL) or 9094 (SASL_SSL) for all production traffic. Port 9092 (PLAINTEXT) is acceptable only within a fully trusted private network where you control all hosts. Any cross-network or multi-tenant environment must use encrypted+authenticated listeners.