IPFS peer-to-peer swarm traffic, and the legacy client port of etcd v2 — two very different things behind one number.
IANA registers 4001 as newoak, which is dead. In practice 4001 has two live meanings. IPFS (Kubo) uses it as the default swarm port for peer-to-peer connections over TCP and QUIC, and its documentation recommends 4001 when you are unsure what to open. Separately, etcd's v2-era default listened for clients on both 2379 and the legacy 4001, and old Kubernetes and CoreOS tooling still references it. Which one you have changes the answer completely, so identify the process before you decide anything.
Expose with care
An IPFS swarm port is meant to be reachable and is fine to open. A legacy etcd client port is the opposite: it is the cluster's key-value store, historically served over plain HTTP with no authentication, and must never be exposed.
$ sudo lsof -nP -iTCP:4001 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.