# WHATPORT(9000)

## NAME

port 9000 — PHP-FPM, ClickHouse native protocol — A heavily overloaded port: PHP-FPM's FastCGI socket, ClickHouse's native protocol, and several self-hosted consoles.

Protocol: TCP  
IANA: cslistener

## DESCRIPTION

IANA registers 9000 as cslistener, but you will meet it as PHP-FPM listening for FastCGI (`listen = 127.0.0.1:9000`) or as ClickHouse's native client/server protocol. Several self-hosted tools also default here, so identify the service before assuming. PHP-FPM is the dangerous case: the protocol is FastCGI, not HTTP, so a browser gets nothing while an attacker gets code execution.

## EXPOSURE

**Do not expose.** PHP's own manual states an exposed FastCGI endpoint allows arbitrary code execution, and listen.allowed_clients is unset by default.

## CHECK

```sh
sudo lsof -nP -iTCP:9000 -sTCP:LISTEN
```

## SEE ALSO

- docs — [PHP Manual — FPM configuration (listen, listen.allowed_clients warning)](https://www.php.net/manual/en/install.fpm.configuration.php) (php.net)
- docs — [ClickHouse — Network ports (9000 native protocol)](https://clickhouse.com/docs/guides/sre/network-ports) (clickhouse.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 9000](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9000) (iana.org)

---

HTML: <https://whatport.net/9000/> · JSON: <https://whatport.net/9000.json> · full dataset: <https://whatport.net/ports.json>