9000

Port 9000/tcp is registered with IANA as cslistener with the description "CSlistener," assignee and contact David Jones, and a blank reference field (dual-registered on TCP and UDP with an identical, equally sparse row). That registration is a legacy assignment: there is no RFC or reference cited in the IANA registry, no registration or modification date on file, and — like many older port assignments — it carries essentially no real-world footprint. What actually makes port 9000 matter to an analyst is that it became a de-facto default for several unrelated developer and infrastructure tools that each independently picked 9000 as a memorable, otherwise-idle port in the registered range, none of them related to the IANA cslistener name. The most common are PHP-FPM (FastCGI Process Manager), which listens on 9000/tcp by default in many distributions (though production setups often switch to a Unix socket); SonarQube, whose web UI and server bind to 9000/tcp by default; MinIO, the S3-compatible object store, which serves its S3 API on 9000/tcp by default (its console UI moved to 9001 in newer releases); Xdebug 2, the PHP debugger, whose default remote-debug listener was also 9000; and older Portainer container-management installs, which used 9000/tcp for HTTP before defaulting to 9443/HTTPS in current versions. Because MinIO and Xdebug 2 both defaulted to 9000, they are a documented collision on shared developer hosts — a MinIO GitHub issue records the conflict and the maintainers keeping 9000 as the default, advising users to rebind. For reconnaissance, an open 9000/tcp is therefore ambiguous: it is a fingerprint for SonarQube or MinIO more often than for anything named cslistener, and exposed unauthenticated SonarQube instances are a recurring deployment risk that can leak project names, source, findings, and tokens. That is a configuration/exposure problem, not a flaw in the port.

IANA assignment

cslistener — "CSlistener"; reference (blank — no RFC cited in IANA registry); assignee/contact David Jones; dual-registered 9000/tcp + 9000/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV lines 12002/12003; live https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9000)

Registration/modification date

none on file in the registry (blank) [Confirmed] — cached registry CSV

Range class

registered (1024–49151)

Related ports

9001 (MinIO console in newer versions), 9443 (Portainer HTTPS default), 8080/8000 (common alternate rebinds)

Security implications

SonarQube/MinIO on 9000 make it a scanning fingerprint (Nmap/Shodan/Censys); exposed unauthenticated SonarQube instances can leak project names, source, security findings, API tokens, and hardcoded credentials — a deployment/exposure risk, not a port flaw

Malware/trojan association

Unknown — no verifiable, dated source found this pass tying 9000/tcp to a named malware family; some general port-DB sites list historical trojans for 9000 but could not be reliably fetched/verified (403), so left unconfirmed rather than repeated

Typically seen on

developer/CI hosts and object-storage/container-management deployments; ambiguous by itself — banner-grab to disambiguate SonarQube vs MinIO vs PHP-FPM

Primary de-facto use

not driven by the IANA name; port 9000/tcp is a shared default for PHP-FPM, SonarQube (web UI/server), MinIO (S3 API), Xdebug 2, and legacy Portainer [Likely] — https://github.com/minio/minio/issues/7036, port-database write-ups

Port conflict note

MinIO's default 9000 collides with Xdebug 2's default 9000; MinIO issue #7036 documents this and keeps 9000 as default (rebind via --address ":8000" to avoid) [Confirmed] — https://github.com/minio/minio/issues/7036

Analyst note

An open 9000/tcp is far more likely a modern dev/infra tool than the IANA cslistener service; fingerprint the actual service and check SonarQube/MinIO for unauthenticated exposure.

Port 9000/udp shares its IANA registration with 9000/tcp: both are listed in the IANA Service Name and Transport Protocol Port Number Registry under the service name cslistener with the description "CSlistener" and assignee/contact David Jones, and the reference field is blank, so no RFC is tied to the assignment. Registration Date and Modification Date are also blank in the registry. That dual tcp/udp cslistener entry has no verifiable real-world footprint of its own. Unlike 9000/tcp — a busy de-facto port for PHP-FPM, SonarQube, MinIO, Xdebug, and legacy Portainer, all TCP-only — the UDP transport does have one solid, dated first-party convention: Cisco Webex Calling. Cisco's own Webex Calling firewall documentation lists UDP 9000 as a destination port for call media (STUN, SRTP/SRTCP, T.38, DTLS), and a Cisco Community thread notes the Webex client tests UDP 9000 outbound and falls back to TCP if blocked — a genuinely UDP-specific real-time media use, since UDP is preferred over TCP for media to avoid retransmission-induced choppiness. A lower-authority port database also lists UDPCast (LAN disk-image multicasting) on 9000/udp, but flags it "Unofficial" with no first-party citation, so it stays unconfirmed. No UDP-specific malware family could be verified; SANS ISC's Netministrator trojan association on port 9000 applies to the TCP row only and is not carried over. For an analyst, the honest posture is that the formal cslistener label exists on UDP but its main verifiable real-world use is Webex Calling media; a live UDP/9000 responder outside a Webex context warrants case-by-case inspection.

IANA assignment

cslistener — "CSlistener"; reference (blank — no RFC cited in IANA registry); registered for both 9000/tcp and 9000/udp under identical service name/description/assignee, with blank Registration Date and Modification Date [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cached CSV; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9000)

Range class

registered (1024–49151) [Confirmed] — port number falls in the IANA registered range

Prevalence

nmap-services observed open-frequency 9000/udp ≈ 0.001652 — very low (roughly 2 in 1,000 sampled hosts), 240th of 5,615 UDP entries; the TCP sibling 9000/tcp is ≈ 0.002129, so the two transports are seen at broadly similar rates despite the TCP side having far more documented uses

[Likely] — nmap-services dataset

Related ports

9000/tcp (the practically-used sibling under the same cslistener registration); 443 (HTTPS / QUIC UDP); STUN/SRTP-adjacent media ports

Primary use

no established general convention for the UDP transport under the cslistener label; the one verified dated first-party UDP-specific use is Cisco Webex Calling media (STUN, SRTP/SRTCP, T.38, DTLS)

Other/unofficial uses

UDPCast (LAN disk-image/file multicasting) is listed on 9000/udp by a port-database site but tagged "Unofficial" with no first-party citation — treat as unconfirmed

Security implications

Unknown / not specifically reported for the UDP transport. SANS ISC's port-9000 tracker names cslistener for UDP; the Netministrator trojan association there applies to the TCP row only and is NOT carried over. No UDP-specific malware family could be isolated. Any exposed UDP responder outside a known Webex media path should be checked case-by-case for reflection/amplification potential

Typically seen on

Webex Calling media endpoints (client/edge) for real-time audio/video; otherwise no established host/service class for UDP/9000

Assignee / contact

David Jones ([David_Jones]) [Confirmed] — IANA registry CSV

Analyst note

The IANA cslistener registration applies to UDP but has no verified general practical use; its main real-world UDP use is Webex Calling media (STUN/SRTP/SRTCP/T.38/DTLS). Treat a live UDP/9000 responder outside a Webex context as an unknown application service worth inspecting (owning process, banner, reflection/amplification risk).