27017

Port 27017/tcp is the default port for the MongoDB mongod daemon and the mongos query router, and — like Redis, contrary to a common assumption — it is officially registered with IANA, as mongodb with the description "Mongo database system," assignee MongoDB, Inc. and contact Akshay Kumar, registered on 2019-02-21 (27017/udp is Reserved). MongoDB is a document database storing BSON, widely used for application backends, content stores, and analytics. Its wire protocol is the MongoDB Wire Protocol, a BSON-based request/response protocol over TCP; modern versions use the unified OP_MSG opcode. Crucially for security history, early MongoDB shipped with no authentication by default and bound to all network interfaces — a combination that produced one of the most consequential exposure events in database history. The IANA reference field for 27017 is blank, so no RFC is tied to the assignment. The marquee security story is the 2016–2017 "MongoDB apocalypse": tens of thousands of unauthenticated, internet-exposed MongoDB databases were wiped and held for ransom, beginning around late December 2016 and surging in January 2017, as documented by Victor Gevers and the GDI Foundation; later "meow"-style wipers continued the pattern. MongoDB changed the default bindIp to localhost in version 3.6 (2017), materially reducing accidental exposure. For an analyst, a public 27017 is a critical finding — assume probing and ransom risk, verify that authentication is enabled and bindIp is restricted, and check whether the instance was previously wiped.

IANA assignment

mongodb — "Mongo database system"; reference (blank — no RFC cited in IANA registry); assignee MongoDB, Inc., contact Akshay Kumar; registered 2019-02-21 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Prevalence

common open datastore port (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

27018 (shard members); 27019 (config servers); 28017 (legacy HTTP status interface, removed in modern versions)

Primary use

default mongod daemon / mongos router port

Other/unofficial uses

document store for application backends, analytics, content management [Well-established]

Security implications

2016–2017 ransom-wipe wave on unauthenticated internet-exposed instances (GDI Foundation/Victor Gevers); later "meow" wipers; no-auth + bind-to-all default historically; bindIp localhost default in MongoDB 3.6 (2017)

Typically seen on

application backends, analytics platforms, Docker/Kubernetes containers, managed MongoDB endpoints

Analyst note

A public 27017 is a critical finding; assume probing/ransom risk. Verify authentication is enabled, bindIp is restricted, and the instance was not previously wiped.

Port 27017/udp appears in the IANA Service Name and Transport Protocol Port Number Registry as a bare "Reserved" entry: the Service Name, Assignee, Contact, Registration Date, and Reference columns are all blank, and only the Description field carries the word "Reserved." That distinction matters, because 27017 is a number most analysts immediately associate with MongoDB — and that association is correct, but only for TCP. The registry assigns 27017/tcp to the service mongodb ("Mongo database system"), owned by MongoDB Inc. (contact Akshay Kumar) with a registration date of 2019-02-21; the UDP row on the very next line carries none of that metadata. MongoDB itself confirms this split: its client-server wire protocol is the MongoDB Wire Protocol carried over BSON, and every documented network operation — client connections, replica-set traffic, and sharding via mongod/mongos — runs over TCP 27017. MongoDB does not use UDP on this port. Consequently, no mainstream software is documented as using 27017/udp for anything. The well-known internet-exposure story around 27017 (Shodan queries, Shadowserver's "Open MongoDB Report," and the 2015 mass-exposure incident where tens of thousands of unauthenticated MongoDB instances were found publicly reachable) is uniformly about TCP 27017, not UDP. For an analyst, UDP packets to 27017 are therefore an anomaly rather than a service interaction: the most likely (though unverified) explanations are opportunistic random UDP probing or spoofed-source reflection scanning that simply reuses the recognizable port number, not any MongoDB protocol. The honest reading of this entry is that 27017/udp is a reserved, unassigned UDP port with no sourced legitimate use, whose relevance is entirely borrowed from its TCP counterpart.

IANA assignment

udp row is "Reserved" — Service Name blank, Assignee blank, Contact blank, Registration Date blank, Reference blank [Confirmed] — IANA service-names-port-numbers registry (local snapshot, line 13545)

Range class

dynamic/registered upper range (registered ports run 1024–49151; 27017 sits inside)

IANA Reference

blank — no RFC is cited for the mongodb registration; blank column stays blank, no RFC invented [Confirmed] — IANA registry

Registration / modification date (UDP)

Unknown — blank in the registry, nothing to record [Confirmed] — IANA registry

Related ports

27017/tcp (mongodb); 27018/tcp and 27019/tcp (MongoDB shard/config-server defaults)

Primary use (UDP)

none documented — MongoDB's wire protocol runs over TCP, not UDP; no software is sourced as using 27017/udp

Common software

MongoDB mongod/mongos — but strictly via TCP 27017, not this UDP port

Typically seen on

nothing standard — a UDP packet to 27017 is an anomaly, not a MongoDB channel

TCP dual-registration

27017/tcp IS assigned to mongodb ("Mongo database system"), assignee MongoDB Inc., contact Akshay Kumar, registration date 2019-02-21 [Confirmed] — IANA registry (line 13544)

Security / exposure notes

all public exposure discussion (Shodan, Shadowserver Open MongoDB Report, 2015 mass unauthenticated-instance exposure) pertains to TCP 27017; no distinct 27017/udp scanning pattern is sourced. UDP packets to 27017 are most likely opportunistic probing or spoofed-source reflection scanning

[Likely] — Shadowserver, contemporaneous 2015 reporting

Analyst note

Do not treat 27017/udp as a MongoDB channel. Legitimate MongoDB traffic is TCP-only; UDP on this port warrants investigation as scanning or reflection, not a database interaction.