9300

Port 9300/tcp is registered with IANA as vrace — "Virtual Racing Service" — assignee and contact Pete Loeffen, with a registration date of 2006-10 and blank Reference, Modification Date, Service Code, Unauthorized Use Reported, and Assignment Notes fields; the identical entry is dual-registered on 9300/udp. In practice, however, the registered vrace name is nearly invisible on the modern internet, and 9300/tcp is overwhelmingly recognized as the default Elasticsearch transport port. Elasticsearch uses transport.port (default range 9300–9400, binding the first free port in that range) for node-to-node communication inside a cluster: cluster formation and discovery, cluster-state exchange, shard allocation, data replication, and remote-cluster connections. This is distinct from 9200/tcp, the client-facing HTTP REST API. For an analyst, the security posture is the key point: the transport port is meant strictly for internal, trusted-network traffic between nodes and should never be exposed to the public internet. Historically, unauthenticated or exposed Elasticsearch clusters — most often reached via 9200, sometimes with 9300 also reachable — have been swept up in mass ransom and data-wiping campaigns, and cloud posture tools explicitly flag unrestricted inbound access to TCP 9300 as a finding to remediate. No IANA RFC or reference is cited for this port, and no CVE is uniquely tied to the transport protocol itself as distinct from Elasticsearch software vulnerabilities generally — so a responsive 9300 is best read as an Elasticsearch cluster node whose internal transport interface is reachable, and its exposure investigated.

IANA assignment

vrace — "Virtual Racing Service"; reference (blank — no RFC cited in IANA registry); assignee/contact Pete Loeffen; registration date 2006-10; dual-registered 9300/tcp + 9300/udp (identical rows) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cache the IANA Service Name and Transport Protocol Port Number Registry lines 12204-12205)

Range class

registered (1024–49151)

IANA Reference

blank (no RFC) [Confirmed] — IANA registry

Modification Date

blank [Confirmed] — IANA registry

Related ports

9200/tcp (Elasticsearch client HTTP REST API)

Primary use

de facto Elasticsearch transport interface — transport.port default range 9300–9400 for node-to-node cluster communication (discovery, cluster-state, shard allocation, replication, remote-cluster); distinct from client-facing 9200/tcp HTTP API

Common software

Elasticsearch (all supported versions) defines and uses 9300 by convention; no other widely documented software claims 9300 as a default

Security implications

transport port is for internal trusted-network node-to-node traffic only and should never be internet-exposed; exposed/unauthenticated Elasticsearch clusters (mostly via 9200, sometimes 9300 reachable) have been targeted in mass ransom/wiping attacks; cloud posture tools flag unrestricted inbound TCP 9300; no CVE uniquely tied to the transport protocol itself (treat such claims as Unknown absent a citation)

Typically seen on

Elasticsearch cluster nodes (internal networks); a public-facing 9300 is a misconfiguration worth investigating

Registered vs de facto

the IANA-registered vrace/Virtual Racing Service is essentially unseen in practice; 9300 is dominated by the Elasticsearch transport convention (not an IANA assignment) [Confirmed] — IANA registry + Elastic docs

Analyst note

A responsive 9300 most likely indicates an Elasticsearch node's transport interface; if reachable from untrusted networks, treat as an exposure to remediate, not a normal internet-facing service.

Port 9300/udp is registered with IANA as vrace with the description "Virtual Racing Service," assignee and contact both listed as Pete Loeffen, registration date 2006-10, and a blank reference field — the same assignment is dual-registered on 9300/tcp with an identical row. This is a niche, decade-plus-old allocation for which no evidence of active, real-world protocol traffic was found; treat the registered "Virtual Racing Service" as a name-holder rather than a service an analyst is likely to encounter. The reason port 9300 matters in practice is almost entirely unofficial and specifically TCP: 9300 is the well-known default transport port Elasticsearch uses for inter-node cluster communication and remote-cluster connections, carrying a custom binary protocol over long-lived TCP channels per Elastic's own networking documentation. That de-facto use is not IANA-registered and is not UDP — Elasticsearch does not speak UDP on 9300, and UDP appears in the registry only because IANA assigns port numbers as a TCP/UDP pair. No sourced evidence was found for a distinct, common UDP-specific protocol or product bound to 9300/udp beyond the generic vrace registration, so for an analyst 9300/udp should be treated as effectively unused/rare and should not be described as running Elasticsearch. The security relevance that does exist — internet-exposed, unauthenticated Elasticsearch clusters flagged by Shodan and security write-ups (the 9200/9300 pair), risking data exposure and cluster takeover — concerns the TCP transport port, not UDP; no UDP-specific scanning or abuse pattern for 9300 was documented in this pass. A responsive 9300/udp is therefore anomalous and worth investigating rather than assuming a known service.

IANA assignment

vrace — "Virtual Racing Service"; assignee Pete Loeffen; contact Pete Loeffen; registration date 2006-10; reference (blank — no RFC cited in IANA registry); dual-registered 9300/tcp + 9300/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (cached IANA Service Name and Transport Protocol Port Number Registry)

Range class

registered/user (1024–49151)

Registration date

2006-10 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry Registration Date column

Modification date

blank in registry (left blank) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

IANA reference

blank — no RFC cited by IANA for this entry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry Reference column

Related ports

9200 (Elasticsearch HTTP REST API, TCP); 9300/tcp (same vrace registration + Elasticsearch transport)

Other/unofficial uses (TCP, not UDP)

default Elasticsearch transport port for inter-node cluster + remote-cluster communication over a custom binary protocol on long-lived TCP channels — unofficial, not IANA-registered

Security implications

exposure/scanning risk (Shodan, unauthenticated cluster access → data exposure, cluster takeover) applies to the Elasticsearch TCP transport pair 9200/9300, not to UDP; no UDP-specific abuse pattern documented

Typically seen on

no reliable UDP association; a responsive 9300/udp is an anomaly worth investigating

Primary UDP use

Unknown — no sourced evidence of a distinct, common UDP protocol bound to 9300 beyond the generic vrace registration [Unknown] — W1 web angle, no verifiable UDP-specific source found

Secondary mentions (low-confidence, TCP context)

port-database sites additionally list IBM Cognos BI and EdgeVis Server on 9300 in some deployments; unverified against vendor-primary docs [Unknown] — https://www.speedguide.net/port.php?port=9300, https://support.edgevis.com/en/articles/27939

Analyst note

Record the IANA vrace assignment; do NOT attribute Elasticsearch to 9300/udp — Elasticsearch's transport is TCP-only. Leave any primary UDP-use claim Unknown rather than fabricating one.