Skip to main content
protocols.pageprotocols.page
9100

Port 9100 – Prometheus Node Exporter / JetDirect

TCP

Port 9100 is shared by Prometheus Node Exporter (Linux system metrics) and HP JetDirect (network printing raw protocol). Context determines the service. Node Exporter on 9100 exposes detailed system metrics – restrict to Prometheus scrapers only. JetDirect on 9100 accepts raw print data with no authentication.

Port Number

9100

Protocol

TCP

Service

Node Exporter / Printer

Range

IANA Registered (1024–49151)

Description

Prometheus Node Exporter serves system metrics (CPU, memory, disk, network, filesystem) on port 9100 at /metrics in Prometheus exposition format. It is the standard way to monitor Linux hosts with Prometheus. HP JetDirect also uses port 9100 for raw TCP printing – clients send print data directly to port 9100 with no protocol overhead. Node Exporter metrics reveal detailed system information: filesystem mount points, network interface names, CPU model, kernel version, and running processes (with --collector.processes). Restrict port 9100 to your Prometheus server's IP via firewall rules. For JetDirect printers, port 9100 accepts any data as a print job – exposed network printers are regularly used for spam printing by internet scanners.

Security risks

  • 1System reconnaissance via Node Exporter: /metrics exposes CPU model (node_cpu_info), kernel version (node_uname_info), filesystem mount points (node_filesystem_*), network interfaces, disk serial numbers, and memory layout – complete host fingerprinting for targeted attacks.
  • 2Process enumeration: with --collector.processes enabled, Node Exporter reveals all running processes, their states, and resource consumption – equivalent to remote ps aux without authentication.
  • 3JetDirect abuse (printers): port 9100 accepts raw data as print jobs with zero authentication. Internet scanners regularly send print jobs to exposed printers (spam pages, ASCII art, offensive content). Also used for printer DoS (send infinite data).
  • 4Printer firmware exploitation via JetDirect: HP printers accepting PJL commands on port 9100 can be reconfigured (change display message, reset admin password, redirect print jobs to attacker). CVE-2017-2741: HP printers RCE via crafted PJL on port 9100.
  • 5Node Exporter as side channel: metrics like node_network_transmit_bytes_total and node_disk_read_bytes_total leak application activity patterns – an attacker monitoring metrics over time can infer when backups run, deploy cycles happen, or sensitive operations occur.

Firewall guidance

For Node Exporter: restrict port 9100 to your Prometheus server IP(s) only. Use --web.listen-address=PRIVATE_IP:9100 to avoid binding all interfaces. In Kubernetes, use PodMonitor/ServiceMonitor with NetworkPolicy restricting scrape access. For JetDirect printers: restrict port 9100 to print server IPs. Never expose printers to the internet – use IPP with authentication (CUPS on port 631) instead.

Diagnosis commands

Count Node Exporter metrics (typical: 500-2000 depending on collectors enabled)

shell
curl -s http://host:9100/metrics | grep -c '^node_'

Check what system info Node Exporter reveals (kernel, hostname, machine type)

shell
curl -s http://host:9100/metrics | grep node_uname_info

Query HP printer status via JetDirect PJL (if this works, printer is exposed)

shell
echo -e '\x1b%-12345X@PJL INFO STATUS
' | nc -w3 printer 9100

Check if JetDirect printer is accessible and read its display message

shell
nmap -p 9100 --script pjl-ready-message target

Usage examples

Port 9100 – Prometheus Node Exporter / JetDirect
shell
curl http://host:9100/metrics | head -20
node_exporter --web.listen-address=:9100
echo 'Hello' | nc printer 9100 (prints raw text on JetDirect)

Common services on this port

Prometheus Node ExporterHP JetDirectAppSocket/raw TCP printingCUPS raw backendWindows Exporter (port 9182 equivalent)

Related ports

9090

Prometheus server (scrapes from 9100)

9091

Pushgateway (batch job metrics)

631

IPP/CUPS (modern print protocol)

515

LPD (legacy line printer daemon)

History

HP JetDirect (AppSocket/raw printing protocol) has used port 9100 since the early 1990s for network printing. Prometheus Node Exporter adopted port 9100 in 2014 following the Prometheus port allocation convention (9090 for server, 9091 for Pushgateway, 9100 for Node Exporter). The collision is rarely a problem in practice since printers and Linux monitoring servers occupy different network segments. Node Exporter is the most widely deployed Prometheus exporter, running on virtually every monitored Linux host.

FAQ

How do I restrict which metrics Node Exporter exposes?

Disable collectors you do not need: node_exporter --no-collector.wifi --no-collector.nfs --no-collector.infiniband. For process info (high-value to attackers): do not enable --collector.processes unless needed. Use --web.config.file with TLS and basic auth (Node Exporter 1.5+) for authenticated scraping. The /metrics endpoint cannot be partially restricted – it is all or nothing per collector.

How do I secure network printers on port 9100?

Place printers on a dedicated VLAN with no internet access. Allow port 9100 only from print servers (CUPS/Windows Print Server). Disable JetDirect if using IPP (port 631) instead. Set a PJL password on HP printers: @PJL DEFAULT PASSWORD=1234. Update firmware – many JetDirect RCE vulns are fixed in newer firmware. Monitor: Shodan your public IPs for port 9100 exposure.