CyberHunter
Local dataset, no network
// Web

Port 3000: Dev servers / Grafana

Default port of many development servers (Node.js, React, Rails) and Grafana.

GrafanaNode.js dev serverReact dev server
3000

How Dev servers / Grafana works

Web
browser:3000pw=1234 browser:3000pw=1234

A browser sends an HTTP request to port 3000 and the Dev servers / Grafana server sends the page back. It travels in clear text: anyone on the path can read it, passwords included.

Transport
TCP · UDP
Exposure risk
5/10 moderate if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
Web
01 Security

Is port 3000 dangerous?

Common attacks and weaknesses

  • Development servers exposed with debug features.
  • Grafana with default admin/admin credentials or vulnerable plugins.

How to secure it

  • Never expose dev servers; bind them to 127.0.0.1.
  • Change Grafana credentials and keep it patched.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 3000

ServicePortTransportDescriptionReferenceUpdated
hbci 3000 TCP, UDP HBCI - -
remoteware-cl 3000 TCP, UDP RemoteWare Client - -

// source: IANA service name and port number registry

03 Check it

Which program uses port 3000, and is it reachable?

Linux

sudo ss -ltnup 'sport = :3000'      # process listening on 3000
sudo lsof -nP -i :3000

macOS

sudo lsof -nP -i :3000

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 3000 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 3000
netstat -ano | findstr :3000

From another machine

nmap -p 3000 -sV <host>
sudo nmap -sU -p 3000 <host>
nc -zv <host> 3000

Block it in the firewall

sudo ufw deny 3000/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 3000" -Direction Inbound -LocalPort 3000 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 3000 used for?

Default port of many development servers (Node.js, React, Rails) and Grafana.

Is port 3000 TCP or UDP?

Port 3000 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 3000?

It is rated 5/10 (moderate) when exposed to the Internet. Development servers exposed with debug features. Never expose dev servers; bind them to 127.0.0.1.

How do I check if port 3000 is open?

On Linux run "ss -ltnup 'sport = :3000'", on macOS "lsof -nP -i :3000", and on Windows "netstat -ano | findstr :3000" to see the local process. From another machine, "nmap -p 3000 <host>" shows whether it is reachable.

05 Related
:443 HTTPS tcp · udp · sctp · low risk :80 HTTP tcp · udp · sctp · moderate risk :8080 HTTP alternate tcp · udp · high risk :8443 HTTPS alternate tcp · udp · moderate risk :5000 Flask / Docker registry / UPnP tcp · udp · moderate risk :8000 HTTP alternate (dev) tcp · udp · moderate risk :8888 Jupyter / HTTP alternate tcp · udp · high risk :9443 HTTPS alternate (admin) tcp · udp · moderate risk

Latest vulnerability news

All news