Port 9160 – Apache Cassandra Thrift

TCP

Port 9160 is the Apache Cassandra legacy Thrift API port. Thrift was Cassandra's original client protocol, now deprecated in favor of the native CQL protocol on port 9042. Port 9042 should be used for all new Cassandra clients. Port 9160 can be disabled in most Cassandra 4+ deployments.

Port Number

9160

Protocol

TCP

Service

Cassandra Thrift API (legacy)

Range

IANA Registered (1024–49151)

Description

Cassandra's Thrift protocol on port 9160 was the original client API, deprecated since Cassandra 2.2 and removed in Cassandra 4.0. The current native protocol (CQL) uses port 9042. Cassandra also uses port 7000 for inter-node gossip and 7001 for TLS gossip. Port 9160 should be disabled in any deployment using Cassandra 3.x+ unless legacy clients require it.

Security risks

1Deprecated and unmaintained: Cassandra Thrift interface (port 9160) received no security patches after Cassandra 4.0 removed it – running it means no future CVE fixes
2No authentication by default: Thrift API allowed full read/write to all keyspaces without credentials (authenticator: AllowAllAuthenticator in cassandra.yaml)
3No encryption: Thrift protocol transmits all data in cleartext – column family data, queries, and any authentication tokens visible on the wire
4Legacy client compatibility: some applications still connect to 9160 instead of 9042, bypassing CQL-level permissions and audit logging configured for the native protocol
5Information disclosure: Thrift describe_cluster, describe_keyspaces, describe_ring leak full cluster topology, token ranges, and schema to any connected client

Firewall guidance

If running Cassandra 3.x or earlier: disable the Thrift server (start_rpc: false in cassandra.yaml) unless legacy clients absolutely require it. If Thrift must run, restrict port 9160 to specific legacy client IPs only. Migrate all clients to CQL (port 9042) which supports authentication, TLS, and RBAC. Cassandra 4.0+ has removed Thrift entirely.

Diagnosis commands

Check if Thrift server is running (should say 'not running' in modern clusters)

shell

nodetool statusthrift

Disable Thrift server without restart (temporary, resets on restart)

shell

nodetool disablethrift

Check if Thrift is enabled in config (should be false or absent)

shell

grep 'start_rpc' /etc/cassandra/cassandra.yaml

Verify nothing is listening on 9160

shell

ss -tlnp | grep 9160

Usage examples

Port 9160 – Apache Cassandra Thrift

shell

cqlsh localhost 9042
nodetool status
netstat -tlnp | grep 9042

Common services on this port

Apache Cassandra (pre-4.0)DataStax Enterprise (legacy mode)ScyllaDB (Thrift compatibility)

Related ports

9042

CQL native protocol (current standard)

7000

Cassandra inter-node gossip

7001

Cassandra inter-node TLS

7199

Cassandra JMX (nodetool)

History

Cassandra originally used Facebook's Thrift RPC framework (port 9160) as its client protocol when open-sourced in 2008. CQL (Cassandra Query Language) was introduced in Cassandra 0.8 (2011) on port 9042 as a SQL-like replacement. Thrift was deprecated in Cassandra 3.0 (2015) and completely removed in Cassandra 4.0 (2021). The Thrift API lacked features like prepared statements, pagination, and lightweight transactions.

FAQ

My application uses port 9160 – how do I migrate to CQL?

Replace Thrift client libraries (Hector, Astyanax, pycassa) with CQL drivers (DataStax Java Driver, python-driver, gocql). CQL uses port 9042. Key differences: CQL uses tables instead of column families, prepared statements for performance, and native protocol v4/v5 for streaming. Schema migration: CQL tables map 1:1 to Thrift column families. Test with dual-read (read from both) before cutting over.

Does ScyllaDB still support Thrift?

ScyllaDB maintained Thrift compatibility longer than Apache Cassandra for migration ease, but deprecated it in ScyllaDB 5.0 (2022) and removed it in 6.0. All ScyllaDB deployments should use CQL on port 9042. ScyllaDB's CQL implementation is wire-compatible with Cassandra's native protocol.