# WHATPORT(2004)

## NAME

port 2004 — Graphite carbon (pickle) — Graphite's pickle receiver — the batched, binary sibling of 2003.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 2004/tcp as mailbox, a name with no live meaning. In practice it is carbon's pickle receiver, which Graphite documents as running on port 2004 by default and which accepts batches of metrics in Python's pickle serialization instead of one line at a time. It is what carbon-relay and high-volume senders use, so it usually appears alongside 2003 on the same monitoring host.

## EXPOSURE

**Do not expose.** Unauthenticated like 2003, and it deserializes attacker-supplied pickle data — keep it strictly on the private network.

## CHECK

```sh
nc -vz TARGET 2004
```

## SEE ALSO

- docs — [Graphite documentation — Feeding In Your Data (pickle, port 2004)](https://graphite.readthedocs.io/en/latest/feeding-carbon.html) (graphite.readthedocs.io)
- source — [graphite-project/carbon](https://github.com/graphite-project/carbon) (github.com)
- iana — [IANA port registry — 2004 (mailbox)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2004) (iana.org)

---

HTML: <https://whatport.net/2004/> · JSON: <https://whatport.net/2004.json> · full dataset: <https://whatport.net/ports.json>