Common attacks and weaknesses
- Unauthenticated access to every log and indexed document; prototype pollution RCE on old versions.
Port 5601: Kibana
Kibana web interface for Elasticsearch.
5601
How Kibana works
Monitoring & loggingA search query goes to port 5601 and the engine returns the matching documents, ranked. It travels in clear text: anyone on the path can read it.
- Transport
- TCP · UDP
- Exposure risk
- 7/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assignedcommon use differs from the registry
- Range
- Registered (1024-49151)
- Category
- Monitoring & logging
Is port 5601 dangerous?
How to secure it
- Enable Elastic security and put Kibana behind SSO.
Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.
IANA registry entries for port 5601
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| esmagent | 5601 | TCP, UDP | Enterprise Security Agent | - | - |
// source: IANA service name and port number registry
Which program uses port 5601, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5601' # process listening on 5601
sudo lsof -nP -i :5601macOS
sudo lsof -nP -i :5601
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5601 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5601 netstat -ano | findstr :5601
From another machine
nmap -p 5601 -sV <host> sudo nmap -sU -p 5601 <host> nc -zv <host> 5601
Block it in the firewall
sudo ufw deny 5601/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5601" -Direction Inbound -LocalPort 5601 -Protocol TCP -Action Block # Windows
What is port 5601 used for?
Kibana web interface for Elasticsearch.
Is port 5601 TCP or UDP?
Port 5601 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 5601?
It is rated 7/10 (high) when exposed to the Internet. Unauthenticated access to every log and indexed document; prototype pollution RCE on old versions. Enable Elastic security and put Kibana behind SSO.
How do I check if port 5601 is open?
On Linux run "ss -ltnup 'sport = :5601'", on macOS "lsof -nP -i :5601", and on Windows "netstat -ano | findstr :5601" to see the local process. From another machine, "nmap -p 5601 <host>" shows whether it is reachable.
Other monitoring & logging ports
:161 SNMP udp · tcp · high risk :162 SNMP trap udp · tcp · moderate risk :9090 Prometheus / admin consoles tcp · udp · high risk :514 Syslog udp · tcp · moderate risk :6514 Syslog over TLS tcp · udp · dccp · low risk :391 SynOptics SNMP Relay Port tcp · udp :412 Trap Convention Port tcp · udp :561 tcp · udp