Internet-Security raven logo internet-security.com

TCP 4040

ProtocolTCP
Port4040
Labels

Synopsis

  • Apache Spark uses TCP 4040 for its driver web UI; when you run spark-shell or submit a job locally it appears at http://localhost:4040, and managed platforms (Databricks, Amazon EMR, Google Dataproc, Azure HDInsight) often proxy this UI from the driver node.
  • ngrok runs its local inspection interface on 127.0.0.1:4040 to view, inspect, and replay HTTP requests that pass through your tunnel.
  • Subsonic media server (and forks such as Airsonic/Airsonic-Advanced) historically default to TCP 4040 for their web interfaces.
  • Security note: attackers sometimes scan for exposed Spark UIs on 4040 to harvest logs/environment variables or submit jobs on misconfigured clusters, and misbound ngrok UIs on 4040 can expose sensitive request data if accessible beyond localhost.

Observed activity

Last 30 days Detailed chart

More information