Port 9999 – Development / Debug

TCP

Port 9999 is commonly used as a generic development, debug, or testing port. Python SimpleHTTPServer alternatives, Quarkus dev, and various internal tools use 9999 as a memorable non-standard port. No single service dominates. Never expose development ports – bind to localhost during development.

Port Number

9999

Protocol

TCP

Service

Various Development Servers

Range

IANA Registered (1024–49151)

Description

Port 9999 is a generic high-numbered port chosen for development servers, test instances, and internal tools because it is easy to remember. Quarkus framework defaults to 9999 for its dev services proxy. Various admin UIs, debug endpoints, and temporary services bind to 9999. Like any development port, services on 9999 typically lack authentication, run with debug logging enabled, and may expose stack traces or internal state. During development, bind to 127.0.0.1:9999 explicitly. In Docker/Kubernetes environments, avoid publishing port 9999 to the host network without intentional access control. Scan your infrastructure for unexpected listeners on port 9999 – they often indicate forgotten development services or debug endpoints that were never cleaned up.

Security risks

1JDWP remote code execution – Java Debug Wire Protocol on port 9999 allows unauthenticated remote code execution. An attacker connects with jdb, sets a breakpoint, and executes arbitrary OS commands via Runtime.exec(). No credentials required.
2Forgotten development servers – services bound to 9999 during development are frequently left running in staging or production. They typically have no auth, debug logging, and stack trace exposure.
3Debug endpoint data leakage – development servers on 9999 often expose /debug, /metrics, /env, or /actuator endpoints revealing environment variables, connection strings, and internal state.

Firewall guidance

Block port 9999 inbound in all environments. Development servers must bind to 127.0.0.1 explicitly. Periodically scan infrastructure for unexpected listeners on 9999 – they almost always indicate forgotten dev instances. In Docker, never publish port 9999 without intentional access control.

Diagnosis commands

Fingerprint what is running – look for JDWP, HTTP, or custom protocols

shell

nmap -sV -p 9999 target

Test for Java Debug Wire Protocol – responds with JDWP-Handshake if active (critical: unauthenticated RCE)

shell

echo 'JDWP-Handshake' | nc -w3 host 9999

Identify which process owns port 9999 on the local system

shell

ss -tlnp sport = :9999

Usage examples

Port 9999 – Development / Debug

shell

python3 -m http.server 9999 --bind 127.0.0.1
quarkus.dev-services.port=9999
nmap -p 9999 target (check for forgotten dev services)

Common services on this port

Quarkus dev services proxyPython HTTP serversJava JDWP debuggercustom admin/debug tools

Related ports

5005

Java debug (JDWP standard)

8000

Development server (common alt)

3000

Node.js dev server default

History

Port 9999 has no RFC assignment. Its popularity as a development port comes from being the highest 4-digit repeating number – easy to type and remember. Quarkus adopted it for dev services in 2021. The JDWP association dates to early Java (late 1990s) when developers commonly used -agentlib:jdwp=transport=dt_socket,server=y,address=9999 for remote debugging.

FAQ

Is JDWP on port 9999 dangerous?

Critically dangerous. JDWP has no authentication. Anyone who can connect executes arbitrary code as the JVM process user. A single exposed JDWP port = full server compromise. Never enable JDWP address=0.0.0.0 – use address=127.0.0.1 or omit the address parameter (defaults to localhost since JDK 9).

How do I find forgotten services on port 9999?

Run nmap -sV -p 9999 on your entire subnet (nmap -sV -p 9999 10.0.0.0/24). Any response indicates a forgotten service. On each host: ss -tlnp sport = :9999 identifies the process. Kill it and remove from startup scripts.