9090

Port 9090/tcp carries a wide gap between its registry name and its real-world traffic. IANA registers 9090/tcp (and 9090/udp) as websm — "WebSM" — with assignee and contact [I_Hsing_Tsao] and no RFC or reference cited; the registration's date and modification columns are blank in the IANA Service Name and Transport Protocol Port Number Registry. WebSM (Web-based System Manager) was an AIX/PowerHA administration front-end, and that legacy assignment is essentially obsolete on today's internet. What an analyst actually meets on 9090/tcp are two unrelated modern services. First, Prometheus uses 9090 as the default port for its web UI and HTTP query API, so a listener here is very often a metrics/monitoring endpoint being scraped or browsed. Second, Cockpit — the web-based Linux server administration console shipped on RHEL, Fedora, and CentOS — defaults to 9090/tcp over HTTPS, so an open 9090 is frequently a management console. Beyond those two, 9090 turns up informally as a generic alternate-HTTP or dev-server port and has been reported fronting OpenShift, Openfire's XMPP admin console, the Cherokee web server admin interface, and some Qlik Sense deployments (secondary aggregator reports, not canonical). Security-wise, 9090 is a well-known scanner target precisely because it so often fronts admin or metrics endpoints that historically ship without authentication: Prometheus's web UI and API have no built-in access control out of the box, and the usual guidance is to put it behind an authenticating reverse proxy or restrict it to internal/VPN-only reach rather than expose it directly. General hardening for any 9090 listener is the same — keep software patched, do not expose admin/metrics endpoints publicly, and use TLS. The entry should keep the technically-correct-but-obsolete IANA websm registration and the de facto modern usage clearly distinguished; IANA did not register Prometheus or Cockpit for this port.

IANA assignment

websm — "WebSM"; reference (blank — no RFC cited in IANA registry); assignee/contact [I_Hsing_Tsao]; dual-registered 9090/tcp + 9090/udp with identical fields [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, rows 12066–12067)

Registration/modification date

blank in registry — Unknown (not fabricated) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Related ports

9091 (Prometheus Pushgateway), 9093 (Alertmanager), 3000 (Grafana), 443/80 (HTTP/S)

Primary use (de facto)

Prometheus default web UI / HTTP query API port; Cockpit Linux web admin console default (9090/tcp over HTTPS)

Other/unofficial uses

generic alternate-HTTP / dev-server port; reported fronting OpenShift console, Openfire XMPP admin, Cherokee admin UI, some Qlik Sense deployments

Security implications

frequent scanner target (fronts admin/metrics consoles); Prometheus web UI/API has no built-in auth by default — guidance is reverse-proxy auth or internal-only exposure; use TLS, patch, don't expose admin/metrics endpoints publicly [Confirmed] — https://last9.io/blog/prometheus-port-configuration/, https://www.pentestpad.com/port-exploit/port-9090-prometheus-prometheus-monitoring

Typically seen on

Prometheus servers; RHEL/Fedora/CentOS hosts running Cockpit; misc. web admin consoles

Legacy meaning

WebSM (Web-based System Manager), the IANA-registered websm name — largely obsolete today [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Analyst note

on 9090, do not assume the IANA websm name reflects reality — a live listener is far more likely Prometheus or Cockpit; distinguish registration from observed use.

Port 9090/udp is registered with IANA as websm with the description "WebSM," assignee and contact [I_Hsing_Tsao] (I-Hsing Tsao, historically listed at an IBM Austin address), and a blank reference field. WebSM is IBM's Web-based System Manager, a legacy remote-administration console for AIX and related IBM Unix systems; the registration is dual-listed on both 9090/tcp and 9090/udp under the same service name and assignee, with the tcp row (line 12066 of the cached IANA CSV) directly preceding the udp row (line 12067). Both the registration date and modification date columns are blank in the source registry, and no RFC or IANA reference is cited, so those fields are recorded here as blank rather than invented. The analytically important caveat is the mismatch between the registration and real-world traffic: in practice, port 9090 is far better known as a TCP port than a UDP one. On TCP it is the de-facto default for Prometheus's web UI and HTTP API, and it has long served as an alternate HTTP / admin-console / proxy port for a variety of software; SANS Internet Storm Center also historically associated 9090 with "Zeus admin server" scanning. Those well-known associations are TCP-centric. No reviewed source documents a distinct, commonly observed UDP-specific application on 9090 beyond the IANA WebSM registration itself — SANS ISC combines TCP and UDP counts on its port page rather than breaking out UDP telemetry — so any claim of active real-world 9090/udp use beyond the registration is treated as Unknown. For an analyst, a listener responding on 9090 is far more likely a TCP monitoring dashboard or admin console than genuine WebSM UDP traffic, and internet-facing instances (Prometheus in particular) are a recognized exposure per cloud security-posture guidance, though that concern is documented for TCP.

IANA assignment

websm — "WebSM"; reference (blank — no RFC/reference cited in IANA registry); assignee/contact [I_Hsing_Tsao]; dual-registered 9090/tcp + 9090/udp [Confirmed] — IANA Service Names and Port Numbers Registry (cached CSV line 12067; tcp counterpart line 12066)

Range class

registered (1024–49151)

Registration date

blank in registry [Confirmed] — IANA CSV (column empty; not fabricated)

Modification date

blank in registry [Confirmed] — IANA CSV (column empty; not fabricated)

Related ports

9090/tcp (identical websm registration; de-facto Prometheus); alternate-HTTP cluster (8080, 8000, 8888)

Other/unofficial uses (predominantly TCP)

Prometheus web UI/HTTP API default port; alternate HTTP / admin-console / proxy port for various software; historical "Zeus admin server" scanning association

Security implications

internet-facing 9090 (especially exposed Prometheus dashboards or legacy WebSM consoles) is a recognized exposure; cloud security-posture guidance flags unrestricted inbound access to TCP 9090; SANS ISC threat level green (low) with no CVEs listed at July 2026 check — all TCP-documented, no UDP-specific exploitation pattern found [Likely/Threat-reported] — https://isc.sans.edu/port.html?port=9090 , https://www.stream.security/rules/ensure-there-is-no-unrestricted-inbound-access-to-tcp-port-9090-prometheus

Typically seen on

IBM AIX hosts (registered WebSM); in the wild, TCP monitoring/admin dashboards rather than UDP WebSM traffic

Primary registered use

IBM WebSM (Web-based System Manager), a legacy AIX remote-administration console [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9090

UDP-specific real-world use

Unknown — no reviewed source documents a distinct common application on 9090/udp beyond the IANA WebSM registration [Unknown] — https://isc.sans.edu/port.html?port=9090

Analyst note

Treat the TCP service (Prometheus/admin console) as the far more probable real-world explanation for activity on 9090; genuine 9090/udp WebSM traffic is rare and unverified beyond the registration.