Port 2379 (etcd client)

etcd client API; in Kubernetes it holds the whole cluster state, including Secrets.

Registered (user) port, 1024-49151 TCP Containers and Kubernetes Do not expose to the internet

What port 2379 is used for

etcd client API; in Kubernetes it holds the whole cluster state, including Secrets.

Security: should port 2379 be open?

Do not expose to the internet. Anyone who can read etcd can read every Kubernetes Secret. Require client certificates, allow only the API servers, and encrypt Secrets at rest.

IANA assignment

Service nameProtoDescriptionAssigneeReference

etcd-client TCP etcd client communication CoreOS -

Registry dates for this port: registered 2014-07-09.

Check what is listening on port 2379

Linux: is anything listening on TCP 2379?

sudo ss -tlnp 'sport = :2379'

Linux / macOS: which process owns the port

sudo lsof -nP -i :2379

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':2379 '

Windows (Command Prompt)

netstat -ano | findstr :2379

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 2379 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 2379

From Windows

Test-NetConnection HOST -Port 2379

Block port 2379 in the firewall

ufw

sudo ufw deny 2379/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 2379 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 2379 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 2379' -Direction Inbound -Protocol TCP -LocalPort 2379 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.