Internet-Security raven logo internet-security.com

TCP 15000

ProtocolTCP
Port15000
LabelspsyBNC

Synopsis

  • Envoy Proxy’s admin interface commonly listens on TCP port 15000.
  • Istio service mesh (and distributions such as OpenShift Service Mesh and Anthos Service Mesh) binds each Envoy sidecar’s admin API to 127.0.0.1:15000 for debugging and introspection (e.g., /stats, /config_dump, /clusters).
  • Istio gateways also run Envoy with the admin endpoint on 15000 in many default deployments.
  • Vendors/distributions built on Istio (e.g., Tetrate Istio Distro, Gloo Mesh–managed Istio, Rancher’s Istio) typically inherit this 15000 admin port usage.
  • Security note: the Envoy admin API is unauthenticated; if misconfigured to be publicly reachable (0.0.0.0:15000), attackers can dump configuration or trigger control actions like draining/shutdown (/quitquitquit), leading to information disclosure or service disruption.

Observed activity

Last 30 days Detailed chart

More information