9200
Summary
- // if you see it open
- Open, unauthenticated Elasticsearch on 9200 has caused a long series of major data-exposure breaches (billions of records) because security was not enabled by default in early versions. Elastic made core security free in 7.x (from 7.1, 2019; on-by-default in 8.x). Exposed clusters also hit by ransom/'meow' wipers.
- // common applications
- ElasticsearchOpenSearchLogstashKibana
- // analyst note
- An internet-facing 9200 almost always indicates an exposed Elasticsearch cluster and a likely data-leak risk. Fingerprint the HTTP JSON banner (
version,cluster_name) rather than trusting thewap-wspregistry name.
About port 9200/tcp.
Port 9200/tcp is the one entry in this database cluster where the famous service is not the IANA registrant — and that distinction is the whole point of the page. IANA registers 9200 as wap-wsp, the WAP (Wireless Application Protocol) connectionless session service, a relic of the early feature-phone mobile-web era (the WAP Forum / Open Mobile Alliance defined ports 9200–9203 for WSP/WDP, with 9200 used by WAP gateways and proxies). The service that actually answers on 9200 across the modern internet is Elasticsearch's HTTP REST/JSON API — but Elasticsearch appears nowhere in the IANA row for this port, so its use is purely de-facto and unofficial. The same pattern holds for its sibling: Elasticsearch's binary inter-node transport runs on 9300, which IANA registers as vrace, also unrelated to Elastic. Elasticsearch itself is a distributed search and analytics engine built on Apache Lucene; 9200 carries HTTP/1.1 with JSON bodies for indexing, search, and cluster management, while 9300 carries the node-to-node transport for cluster gossip, shard movement, and query fan-out. Security here is a major data-exposure story: open, unauthenticated Elasticsearch on 9200 has produced a long series of large breaches — billions of records leaked from misconfigured clusters reachable on the public internet — because security (authentication and TLS) was not enabled by default in early versions; Elastic later made core security features free in the 7.x line (notably from 7.1 in 2019, with on-by-default security in 8.x), and exposed clusters have also been hit by ransom and "meow"-style wiper attacks. For an analyst, an internet-facing 9200 almost always indicates an exposed Elasticsearch cluster and a likely data-leak risk — and the right move is to fingerprint the HTTP response (Elasticsearch returns a JSON banner with version and cluster_name) rather than trusting the wap-wsp registry name.
- IANA assignment
wap-wsp— WAP connectionless session service (WAP Forum / OMA lineage); reference (blank — no RFC cited in IANA registry); Elasticsearch is NOT the IANA registration [IANA-assigned for wap-wsp] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- recognized open service in scans; Elasticsearch common in ELK deployments (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 9300 (
vraceper IANA; Elasticsearch transport de-facto); 9201/9202/9203 (other WAP ports); 5601 (Kibana, de-facto)
De-facto use
Elasticsearch HTTP REST/JSON API
Primary use (de-facto)
Elasticsearch indexing/search/cluster-management REST API
Other/unofficial uses
legacy WAP gateway/proxy (historical); 9201/9202/9203 are the other WAP ports [Well-established]
Security implications
unauthenticated exposed Elasticsearch → mass data-leak breaches; security not on by default in early versions (free security from 7.1, 2019; on-by-default 8.x); ransom/"meow" wipers
Typically seen on
Elasticsearch nodes, ELK-stack hosts (with Logstash/Kibana); often paired with Redis/MongoDB
- Analyst note
- An internet-facing 9200 almost always indicates an exposed Elasticsearch cluster and a likely data-leak risk. Fingerprint the HTTP JSON banner (
version,cluster_name) rather than trusting thewap-wspregistry name.
About port 9200/udp.
Port 9200/udp is registered with IANA as wap-wsp, "WAP connectionless session service," assigned to the WAP Forum, with the reference field left blank (no RFC is cited in the registry). The assignment is dual-registered: both 9200/tcp and 9200/udp carry the identical service name, description, assignee, and contact. The registered service is the connectionless variant of the Wireless Session Protocol from the Wireless Application Protocol stack — the early-2000s technology that carried feature-phone "mobile web" traffic through carrier WAP gateways and proxies. That use is legacy and largely obsolete today. The far more familiar modern association with port 9200 — Elasticsearch's HTTP/REST API — is a TCP-only convention that is unofficial (not IANA-registered) and does not apply to UDP; Elasticsearch does not bind UDP 9200, so any "Elasticsearch on UDP 9200" claim should be treated as unverified. The well-documented exposure and ransom-wiping stories around port 9200 (Shodan-discoverable, authentication-disabled Elasticsearch instances) all pertain to the TCP service, not to this UDP registration. Research found no sourced evidence of scanning campaigns, malware, or exploitation specific to 9200/udp as distinct from the TCP Elasticsearch narrative; SANS ISC tracks port-9200 scan sources but does not break out TCP versus UDP, so UDP-specific volume is not verifiable. For an analyst, 9200/udp is best recorded as an IANA-registered legacy WAP service with low or unknown current real-world usage, not conflated with the TCP Elasticsearch exposure problem.
- IANA assignment
wap-wsp— "WAP connectionless session service"; assignee/contact WAP Forum; reference blank (no RFC cited); dual-registered 9200/tcp + 9200/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9200)- Range class
- registered (1024–49151)
- Registration date
- Unknown — blank in the registry; not surfaced on the IANA page (not fabricated) [Unknown] — IANA registry
- IANA reference
- blank — no RFC cited in the registry row (stays blank per convention) [Confirmed] — IANA registry
- Related ports
- WAP stack neighbors (9200–9203 wap-wsp/wap-wsp-wtp/wap-wsp-s/wap-wsp-wtp-s); contrast the TCP Elasticsearch convention on 9200/tcp
Primary use
WAP Wireless Session Protocol connectionless service — carrier WAP gateway/proxy traffic for early feature-phone mobile browsing; legacy/largely obsolete
Other/unofficial uses
port 9200 is best known as Elasticsearch's default HTTP/REST API port, but that is a TCP-only convention and is not IANA-registered; no widely used software was found using 9200/udp specifically
Security implications (UDP-specific)
no sourced evidence of scanning campaigns, malware, or exploitation targeting 9200/udp distinct from the TCP Elasticsearch exposure story; SANS ISC tracks port-9200 scan sources but does not split TCP vs UDP, so UDP-specific volume is unverifiable
Security implications (TCP context, for contrast)
the widely reported exposure — misconfigured, auth-disabled Elasticsearch found via Shodan, leading to data leaks and ransom-wiping — pertains to TCP/9200, not this UDP registration
Typically seen on
historically, carrier WAP gateways/proxies; otherwise little current legitimate UDP traffic expected
- Analyst note
- record as an IANA-registered legacy WAP service; do not conflate 9200/udp with the TCP Elasticsearch exposure narrative — treat any UDP-9200 Elasticsearch claim as unverified.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| wap-wsp | UDP | WAP connectionless session services | 0.73% |
| wap-wsp | TCP | WAP connectionless session services | 0.02% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.