TCP 9305
Synopsis
- Elasticsearch uses TCP 9300 for inter-node transport; if that port is taken it auto-increments within a range, so additional nodes often bind to 9305 for cluster communication.
- OpenSearch (the Elasticsearch fork) behaves the same way: transport.port defaults to 9300 and will use 9305 when earlier ports are occupied.
- Real-world examples: multi-node Elasticsearch/OpenSearch clusters on a single host (e.g., Docker Compose or dev environments) frequently listen on 9300–9305; Wazuh Indexer (OpenSearch-based) and Elastic stack test clusters exhibit the same transport port usage.
- No notable hacking/exploitation is specifically associated with TCP 9305 beyond general guidance to avoid exposing Elasticsearch/OpenSearch transport ports publicly.
Observed activity
Last 30 days
Detailed chart