9092

Port 9092/tcp carries a split identity that an analyst has to hold in mind at once. In the IANA Service Name and Transport Protocol Port Number Registry the port is registered as XmlIpcRegSvc ("Xml-Ipc Server Reg"), assignee Casey Harrington, registered January 2006, dual-registered on 9092/tcp and 9092/udp with a blank reference field — a legacy assignment that is essentially never seen in the wild. What actually drives traffic on 9092/tcp today is Apache Kafka: the port is the community-standard default for a Kafka broker's PLAINTEXT listener, spoken over Kafka's own binary wire protocol (not HTTP) by producers and consumers. That usage is a project convention set by Apache Kafka circa 2010–2011, well after and unrelated to the IANA registration, so nothing about the Kafka role is IANA-sanctioned. The distinction matters because the two facts point in opposite directions: the registry name is stale and misleading, while the real-world exposure is the Kafka broker. The security posture is the analyst's concern. Kafka's default PLAINTEXT listener on 9092 has no authentication or encryption, so an internet-reachable, misconfigured broker lets unauthenticated clients produce and consume topic data — data theft, injection, and eavesdropping — and such brokers are indexed by internet-wide scanners (Shodan, Censys) the same way any exposed service port is. Cloud-posture tooling ships explicit rules flagging unrestricted inbound access to 9092/tcp. The encrypted companion is conventionally 9093/tcp (SSL/TLS listener), also a deployment convention rather than an IANA assignment, with SASL_PLAINTEXT and SASL_SSL listeners on separately configured ports.

IANA assignment

XmlIpcRegSvc — "Xml-Ipc Server Reg"; assignee Casey Harrington; registered 2006-01; reference field blank; dual-registered 9092/tcp + 9092/udp [Confirmed] — cached IANA the IANA Service Name and Transport Protocol Port Number Registry, lines 12070–12071 (registry-lookup, direct read)

Range class

registered (1024–49151)

IANA vs. real-world note

the IANA XmlIpcRegSvc registration predates and is unrelated to Kafka; Kafka's use of 9092 is not IANA-sanctioned [Likely] — IANA registry (XmlIpcRegSvc sub-fact confirmed from cached CSV; Kafka-predates-registration framing from secondary sources)

Related ports

9093/tcp (Kafka SSL listener), 2181/tcp (legacy ZooKeeper), 8083/tcp (Kafka Connect REST), 8081/tcp (Confluent Schema Registry)

Common software

Apache Kafka brokers; Kafka-compatible/managed distributions — Confluent Platform/Cloud, Amazon MSK, Redpanda; Kafka UI/admin tools (Kafka UI, Kafbat UI, AKHQ)

Security implications

default PLAINTEXT listener has no auth/encryption; internet-exposed misconfigured broker → unauthenticated produce/consume (data theft, injection, eavesdropping); discoverable via Shodan/Censys; posture tools flag unrestricted inbound 9092

Notable CVEs (Kafka ecosystem, not the port itself)

CVE-2025-27817 (Kafka Connect/Client arbitrary file read / SSRF via malicious client config, 2025); CVE-2025-27819 (Kafka Connect/broker RCE/DoS via SASL JAAS JndiLoginModule config, 2025); CVE-2025-49127 (Kafbat UI unauthenticated RCE via unsafe deserialization to a malicious JMX service, 2025)

Primary real-world use

de facto default Apache Kafka broker port (PLAINTEXT listener), Kafka binary wire protocol, not HTTP; a project convention, not an IANA assignment [Confirmed] — AWS MSK port docs, Confluent developer FAQ, rmoff.net Kafka listeners writeup

Encrypted alternative

9093/tcp conventionally used for Kafka's SSL/TLS listener; SASL_PLAINTEXT / SASL_SSL on separately configured ports [Likely] — Confluent developer FAQ

Analyst note

an open 9092/tcp almost always means a Kafka broker; on the public internet treat a PLAINTEXT 9092 listener as a likely misconfiguration and probable unauthenticated data exposure — the XmlIpcRegSvc registry name is a red herring.

Port 9092/udp is registered with IANA under the service name XmlIpcRegSvc with the description "Xml-Ipc Server Reg," assignee and contact Casey Harrington (charrington[at]isxinc.com), registration date 2006-01, and a blank reference field. The same XmlIpcRegSvc service name is dual-registered on both 9092/tcp and 9092/udp with identical description, assignee, contact, and registration date. Despite that formal assignment, no independent evidence was found of real-world software binding to 9092/udp by default — the IANA name appears to be an allocation with little visible deployment. The practical significance of the number 9092 lives almost entirely on TCP: 9092/tcp is the well-known default for Apache Kafka's plaintext broker listener (the PLAINTEXT endpoint used by producers, consumers, and admin clients). A common misconception generalizes this into "port 9092 is Kafka" without specifying transport, but Kafka's wire protocol is a request/response binary protocol that runs over TCP only — there is no native Kafka UDP broker mode — so 9092/udp should not be treated as a Kafka indicator. For an analyst, then, 9092/udp has no confirmed mainstream default consumer: the IANA XmlIpcRegSvc registration is the only formal assignment, Kafka's relevance is TCP not UDP, and observed traffic on port 9092 is dominated by routine internet-wide scanning (SANS ISC shows day-to-day sweep activity with no CVE or named-campaign attribution split out by protocol). UDP-specific exposure datasets are also thin industry-wide because banner-grabbing scanners such as Censys generally do not collect UDP banners, so no dedicated 9092/udp exposure count could be sourced. Treat an unexpected 9092/udp responder as unusual and worth identifying rather than as any recognized standard service.

IANA assignment

XmlIpcRegSvc — "Xml-Ipc Server Reg"; reference (blank — no RFC cited in IANA registry); assignee/contact Casey Harrington (charrington[at]isxinc.com); registration date 2006-01; dual-registered 9092/tcp + 9092/udp [Confirmed] — IANA Service Names and Port Numbers Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9092; the IANA Service Name and Transport Protocol Port Number Registry line 12071)

Range class

registered/user (1024–49151) [Confirmed]

IANA Reference

blank (no RFC) [Confirmed] — IANA registry as-is; not fabricated

Modification date / Service Code / Unauthorized Use Reported / Assignment Notes

blank in registry [Confirmed] — IANA registry as-is

Related ports

9092/tcp (Apache Kafka default plaintext broker listener; also the shared IANA XmlIpcRegSvc registration)

Primary use

no confirmed mainstream software defaults to 9092/udp; the IANA XmlIpcRegSvc assignment is the only formal allocation and shows no visible real-world deployment [Likely] — IANA registry + web review (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9092)

Security implications

SANS ISC shows routine opportunistic internet-wide scanning on port 9092 (protocol not split out in the fetched view) — top source 185.107.80.93 logged ~198 hits/day at time of check with others ~60–70/day, Infocon green (low), no CVE listed; a user comment tying the 9090–9095 range to BitTorrent-adjacent traffic is anecdotal/unverified. Separately, exposed unauthenticated Kafka brokers are a documented risk on 9092/tcp — not 9092/udp [Likely] — SANS ISC (https://isc.sans.edu/data/port/9092); Stream.Security Kafka rule (https://www.stream.security/rules/ensure-there-is-no-unrestricted-inbound-access-to-tcp-port-9092-kafka)

Exposure data

no dedicated 9092/udp Shodan/Censys count found; Censys generally does not banner-grab UDP ports, limiting UDP-specific exposure datasets industry-wide

Typically seen on

no confirmed default consumer; an unexpected 9092/udp responder is an anomaly worth identifying

Common confusion

9092/tcp is Apache Kafka's default plaintext broker port; Kafka's broker protocol runs over TCP only (no native UDP mode), so 9092/udp is NOT a Kafka indicator [Confirmed] — Apache Kafka protocol docs (https://kafka.apache.org/protocol.html); AWS MSK port docs (https://docs.aws.amazon.com/msk/latest/developerguide/port-info.html)

Analyst note

Do not label 9092/udp as "Kafka" — Kafka's broker protocol is TCP-only (no native UDP mode); the Kafka association belongs to 9092/tcp. 9092/udp's only formal identity is the thin, undeployed IANA XmlIpcRegSvc registration from 2006; treat a responder as an anomaly worth investigating.