Port 5601 (Kibana)

Kibana web UI for Elasticsearch (OpenSearch Dashboards uses it too).

Registered (user) port, 1024-49151 TCP Monitoring and logging Expose only to trusted sources

What port 5601 is used for

Kibana web UI for Elasticsearch (OpenSearch Dashboards uses it too).

Security: should port 5601 be open?

Expose only to trusted sources. Exposing Kibana without authentication exposes all the data behind it. Put it behind SSO or a VPN and keep it patched (several RCE bugs in the past).

IANA assignment

Service nameProtoDescriptionAssigneeReference

esmagent TCP Enterprise Security Agent Kimberly Gibbs -

esmagent UDP Enterprise Security Agent Kimberly Gibbs -

Check what is listening on port 5601

Linux: is anything listening on TCP 5601?

sudo ss -tlnp 'sport = :5601'

Linux / macOS: which process owns the port

sudo lsof -nP -i :5601

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':5601 '

Windows (Command Prompt)

netstat -ano | findstr :5601

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5601 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 5601

From Windows

Test-NetConnection HOST -Port 5601

Allow only trusted sources on port 5601 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 5601 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 5601 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5601 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 5601 accept
sudo nft add rule inet filter input tcp dport 5601 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 5601 trusted' -Direction Inbound -Protocol TCP -LocalPort 5601 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.