WHATPORT(9000) whatport.net WHATPORT(9000)
9000

PHP-FPM, ClickHouse native protocol

A heavily overloaded port: PHP-FPM's FastCGI socket, ClickHouse's native protocol, and several self-hosted consoles.

TCP IANA: cslistener

Description

IANA registers 9000 as cslistener, but you will meet it as PHP-FPM listening for FastCGI (listen = 127.0.0.1:9000) or as ClickHouse's native client/server protocol. Several self-hosted tools also default here, so identify the service before assuming. PHP-FPM is the dangerous case: the protocol is FastCGI, not HTTP, so a browser gets nothing while an attacker gets code execution.

Exposed to the internet?

Do not expose

PHP's own manual states an exposed FastCGI endpoint allows arbitrary code execution, and listen.allowed_clients is unset by default.

Check it yourself

$ sudo lsof -nP -iTCP:9000 -sTCP:LISTEN

See also

Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.

Get Beige Box →

also available as JSON · Markdown

Corrections or a missing port? Reply @rimrocksystems.