# WHATPORT(9600)

## NAME

port 9600 — Logstash monitoring API, OMRON FINS — Registered to Micromuse, but in the wild it is either Logstash's monitoring API or an OMRON PLC speaking FINS.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

IANA's assignment is `micromuse-ncpw`, from the Micromuse/Netcool product line. Two unrelated modern uses dominate what you actually find. Logstash binds its HTTP monitoring API to tcp:9600 by default, serving unauthenticated JSON about pipelines, plugins, and JVM state. On industrial networks, OMRON PLCs speak the FINS protocol on 9600 over both TCP and UDP — Nmap ships an `omron-info` script that queries controller details there. A banner grab tells the two apart immediately: JSON means Logstash, binary means a PLC.

## EXPOSURE

**Do not expose.** Both realistic occupants are bad news exposed. The Logstash API is unauthenticated introspection of your pipeline, and FINS is an unauthenticated industrial control protocol that should not touch a routable network at all.

## CHECK

```sh
curl -s http://TARGET:9600/
```

## SEE ALSO

- docs — [Monitoring Logstash with APIs (default binding tcp:9600)](https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html) (elastic.co)
- docs — [Nmap NSE omron-info — OMRON FINS on port 9600](https://nmap.org/nsedoc/scripts/omron-info.html) (nmap.org)
- source — [Logstash source repository](https://github.com/elastic/logstash) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/9600/> · JSON: <https://whatport.net/9600.json> · full dataset: <https://whatport.net/ports.json>