6379

Port 6379/tcp is the default port for the Redis server, and — contrary to a common belief that Redis is unregistered — it is officially registered with IANA as redis, with the description "An advanced key-value cache and store," the assignee listed as Salvatore Sanfilippo (Redis's creator, antirez) and the contact as Itamar Haber, registered on 2015-04-23. The default redis.conf even references the assignment. Redis serves as a caching layer, session store, pub/sub message broker, and real-time data structure server (sorted sets for leaderboards, lists for queues), and is ubiquitous in containerized and cloud stacks. Its wire protocol is RESP (REdis Serialization Protocol), a simple, human-readable, line-based request/response protocol over TCP. Redis historically shipped with no authentication by default; a single shared password via requirepass and later full ACLs (Redis 6, May 2020) were added, and TLS support arrived in Redis 6.0 (conventionally on 6380). The IANA reference field for 6379 is blank, so no RFC is tied to the assignment. The port number itself comes from antirez choosing 6379 because it spells "MERZ" on a phone keypad, after the Italian showgirl Alessia Merz. Security here is one of the marquee exposure stories in networking: an unauthenticated Redis reachable from the internet leads directly to remote code execution — classic chains use CONFIG SET dir/dbfilename to write an SSH authorized_keys file or a cron job, or load a malicious module — and exposed Redis has fueled large cryptomining botnets. In response, "protected mode" was added in Redis 3.2 (2016), refusing external connections when no password or bind is configured. For an analyst, a 6379 reachable from the internet should be treated as a likely-already-compromised, critical finding; confirm protected-mode yes, bind 127.0.0.1, and requirepass/ACLs.

IANA assignment

redis — "An advanced key-value cache and store"; reference (blank — no RFC cited in IANA registry); assignee Salvatore Sanfilippo (antirez), contact Itamar Haber; registered 2015-04-23 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Prevalence

common open datastore port (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

26379 (Redis Sentinel); 16379 (cluster bus = port + 10000); 6380 (TLS by convention)

Primary use

default Redis server port — caching, session store, pub/sub broker, real-time data structures

Other/unofficial uses

message queue / job broker; any RESP-compatible server [Well-established]

Security implications

unauthenticated Redis → RCE (CONFIG SET dir/dbfilename → SSH keys/cron; malicious module load); cryptomining botnets; no-auth by default historically; protected mode added Redis 3.2 (2016); ACLs + TLS in Redis 6.0 (2020)

Typically seen on

application backends, cache tiers, Docker/Kubernetes containers, managed Redis endpoints

Analyst note

A 6379 reachable from the internet should be treated as a likely-already-compromised, critical finding. Confirm protected-mode yes, bind 127.0.0.1, and requirepass/ACLs.

Port 6379/udp appears in the IANA Service Name and Transport Protocol Port Number Registry as a bare "Reserved" row: no Service Name, no Assignee, no Contact, no Registration Date, and a blank Reference field. This is the deliberate flip-side of 6379/tcp, which the same registry assigns to redis — "An advanced key-value cache and store," assignee Salvatore Sanfilippo, contact Itamar Haber, registration date 2015-04-23. IANA reserves the matching UDP number so it cannot be handed to an unrelated service, but it does not assign it to Redis or anything else. The reason UDP stays empty is architectural: Redis speaks RESP (the REdis Serialization Protocol), a request/response wire format that assumes a reliable, ordered byte stream, so Redis servers and clients use TCP exclusively — there is no UDP listener in a stock Redis deployment. For an analyst, that makes 6379/udp a near-nonexistent service surface: no mainstream software is documented as binding it, and any UDP traffic observed on 6379 is far more plausibly scanner sweeps, misconfigured tooling, or backscatter than a real listening service. Note that the well-documented Redis exposure risks — unauthenticated internet-facing instances abused for data theft or cryptomining — are all a 6379/tcp phenomenon; no source found describes 6379/udp as a distinct, actively exploited attack surface. The IANA Reference field is blank and is not fabricated here.

IANA assignment

Reserved — no Service Name, no Assignee, no Contact, no Registration/Modification Date; Reference blank [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV row, 6379/udp)

Range class

registered (1024–49151)

IANA Reference

blank — no RFC governs this reserved UDP slot; not populated with a fabricated reference [Confirmed] — IANA registry

Related ports

6379/tcp (redis); the Redis Sentinel/Cluster TCP ports (16379, 26379) [Likely]

Primary use

none — no service is assigned to 6379/udp; the number is IANA-reserved

Common software on 6379/udp

none documented; observed UDP traffic on 6379 is most plausibly scanner probes / backscatter, not a listening service (inference, not independently confirmed) [Unknown]

Security implications

no source describes 6379/udp as a distinct exploited surface. All documented Redis exposure risk (unauthenticated access, data theft, cryptomining) is on 6379/tcp; internet-wide scanners do sweep UDP 6379 as routine, but not against a known service there [Likely] — https://help.shodan.io/the-basics/on-demand-scanning, https://www.security.gov.uk/services-resources/cyber-and-domains-protection/domain-and-vulnerability-knowledge-base/open-port-6379-redis/

Dual-registration contrast

6379/tcp = redis ("An advanced key-value cache and store"), assignee Salvatore Sanfilippo, contact Itamar Haber, registration date 2015-04-23, Reference blank [Confirmed] — IANA registry (6379/tcp row)

Why UDP is empty

Redis uses RESP over TCP; RESP needs a reliable, ordered stream, so Redis is TCP-only on 6379 and ships no UDP listener [Likely] — https://openportcheckers.com/blog/what-is-port-6379-redis, https://scanitex.com/en/resources/ports/tcp/6379

Analyst note

Treat a "6379/udp open" reading with suspicion — there is no legitimate service here. Investigate as scan noise, a misconfiguration, or a decoy; the real Redis surface to check is 6379/tcp.