8086

Port 8086/tcp carries a split identity worth stating plainly. IANA registers it under the service name d-s-n — "Distributed SCADA Networking Rendezvous Port," assignee Gary Hampton, registered on both TCP and UDP on 2008-02-27 with a blank reference field (no RFC cited). That registration is the formal provenance, but it is not what an analyst actually finds on the wire. In practice 8086/tcp is overwhelmingly the default HTTP API port of InfluxDB, the open-source time-series database from InfluxData: it is the endpoint that the InfluxDB CLI, Chronograf, Grafana data sources, client libraries, and plain curl all use for writes, queries, and administration across InfluxDB OSS v1/v2 and InfluxDB Enterprise (the port is configurable but this is the default). There is no evidence of the SCADA d-s-n protocol being in meaningful current use on this port. For a security analyst the practical read is InfluxDB exposure: internet-facing instances on 8086/tcp are a routine scan/discovery target, and the notable historical issue is CVE-2019-20933, an authentication bypass in InfluxDB before 1.7.6 where a crafted JWT with an empty shared secret defeats authentication on the HTTP API (services/httpd/handler.go), enabling unauthorized reads, data modification, or admin actions; it is fixed in 1.7.6 and later. Standard guidance is to patch InfluxDB and restrict network access to 8086 rather than expose it publicly. Record both facts: the IANA registration for citation/provenance, and the InfluxDB usage for real-world accuracy, kept clearly distinct.

IANA assignment

d-s-n — "Distributed SCADA Networking Rendezvous Port"; reference (blank — no RFC cited in IANA registry); assignee Gary Hampton; registered 2008-02-27; dual-registered 8086/tcp + 8086/udp (identical name/description/assignee/date on both rows)

[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV lines 11582–11583)

Range class

registered (1024–49151)

Modification date / IANA reference / service code / unauthorized-use / assignment notes

blank in the registry — reported as Unknown, not fabricated [Confirmed] — cached registry CSV

Primary use (de-facto)

InfluxDB HTTP API default port — writes, queries, and administration; overwhelmingly dominant real-world usage despite the IANA SCADA registration

Common software

InfluxDB OSS v1/v2 and InfluxDB Enterprise (HTTP API, configurable default 8086); associated consumers include Chronograf, Grafana, the InfluxDB CLI, and InfluxDB client libraries

Security implications

internet-exposed InfluxDB on 8086/tcp is a known scan/discovery target; CVE-2019-20933 is an authentication bypass in InfluxDB before 1.7.6 (crafted JWT with empty shared secret in services/httpd/handler.go → unauthorized read/modify/admin), fixed in 1.7.6+ [Confirmed] — Red Hat Bugzilla, vulhub, nuclei-templates; CVSS 9.8 reported by third-party aggregators only, not verified against primary NVD this pass

SCADA `d-s-n` real-world use

none observed; the IANA name is provenance, not current practice [Likely] — absence of evidence in InfluxData/security sources

Master status

no existing port-8086 row in this site's own enrichment records as of 2026-07-02 — new entry, not a duplicate [Confirmed] — local grep of this site's own enrichment records

Analyst note

on the wire, treat 8086/tcp as InfluxDB until proven otherwise; check version for the pre-1.7.6 auth-bypass and confirm the API is not publicly reachable.

Port 8086/udp is registered with IANA under the service name d-s-n with the description "Distributed SCADA Networking Rendezvous Port," assignee and contact Gary Hampton, registration date 2008-02-27, and a blank reference field. The same d-s-n service name is dual-registered on both 8086/tcp and 8086/udp with identical description, assignee, contact, and registration date. Despite that formal SCADA-flavored assignment, no independent evidence was found of real-world software binding to 8086/udp by default — the IANA name appears to be an allocation with little visible deployment. The practical significance of the number 8086 lives almost entirely on TCP: 8086/tcp is the well-known default for InfluxDB's HTTP API (the write/query endpoint used by the influx CLI, Chronograf, Grafana, and client libraries). A common misconception conflates this into "InfluxDB uses 8086/udp," but InfluxDB's own OSS v1 and Enterprise v1 port documentation is explicit that 8086 is HTTP/TCP only, while InfluxDB's optional UDP line-protocol listener is a separate service that defaults to port 8089 and ships disabled — it is not 8086/udp. For an analyst, then, 8086/udp has no confirmed mainstream default consumer: the IANA d-s-n registration is the only formal assignment, InfluxDB's relevance is TCP not UDP, and observed traffic on port 8086 is dominated by routine internet-wide scanning (SANS ISC shows day-to-day sweep activity with no CVE or named-campaign attribution). UDP-specific exposure datasets are also thin industry-wide because banner-grabbing scanners such as Censys generally do not collect UDP banners, so no dedicated 8086/udp exposure count could be sourced. Treat an unexpected 8086/udp responder as unusual and worth identifying rather than as any recognized standard service.

IANA assignment

d-s-n — "Distributed SCADA Networking Rendezvous Port"; reference (blank — no RFC cited in IANA registry); assignee/contact Gary Hampton; registration date 2008-02-27; dual-registered 8086/tcp + 8086/udp [Confirmed] — IANA Service Names and Port Numbers Registry (cached snapshot; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8086)

Range class

registered/user (1024–49151)

IANA Reference

blank (no RFC) [Confirmed] — IANA registry as-is; not fabricated

Modification date / Service Code / Unauthorized Use Reported / Assignment Notes

blank in registry [Confirmed] — IANA registry as-is

Related ports

8086/tcp (InfluxDB HTTP API); 8089/udp (InfluxDB UDP line-protocol listener, disabled by default)

Primary use

no confirmed mainstream software defaults to 8086/udp; the IANA d-s-n assignment is the only formal allocation and shows no visible real-world deployment [Likely] — IANA registry + web review (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8086)

Security implications

SANS ISC shows routine opportunistic internet-wide scanning on port 8086 (protocol not split out in the fetched view), with day-to-day variation and no CVE or named-campaign attribution

Exposure data

no dedicated 8086/udp Shodan/Censys count found; Censys generally does not banner-grab UDP ports, limiting UDP-specific exposure datasets industry-wide

Typically seen on

no confirmed default consumer; an unexpected 8086/udp responder is an anomaly worth identifying

Common confusion

8086/tcp is InfluxDB's default HTTP API port; InfluxDB's UDP listener is a SEPARATE service defaulting to 8089/udp (disabled by default) — NOT 8086/udp [Confirmed] — InfluxData docs (https://docs.influxdata.com/influxdb/v1/administration/ports/, https://docs.influxdata.com/enterprise_influxdb/v1/administration/configure/ports/)

Analyst note

Do not repeat the common "InfluxDB uses 8086/udp" claim — it is TCP-only; the UDP listener is 8089. 8086/udp has no verified mainstream default use; treat a responder as an anomaly.