Port 8472 (VXLAN (Linux default / Flannel))

The Linux kernel's historic VXLAN port, used by Flannel and k3s by default.

Registered (user) port, 1024-49151 UDP Containers and Kubernetes Do not expose to the internet

Port 8472 is normally used over UDP; the checker tests TCP only, so a "filtered" result does not mean the UDP service is down.

What port 8472 is used for

The Linux kernel's historic VXLAN port, used by Flannel and k3s by default.

Do not expose to the internet. Allow only between cluster nodes; same injection risk as 4789.

Service nameProtoDescriptionAssigneeReference

otv TCP Overlay Transport Virtualization (OTV) Dino Farinacci -

otv UDP Overlay Transport Virtualization (OTV) Dino Farinacci -

Registry dates for this port: registered 2008-01-07.

Linux: UDP 8472

sudo ss -ulnp 'sport = :8472'

Linux / macOS: which process owns the port

sudo lsof -nP -i :8472

Windows (Command Prompt)

netstat -ano | findstr :8472

Windows (PowerShell)

Get-NetUDPEndpoint -LocalPort 8472

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 8472

ufw

sudo ufw deny 8472/udp

iptables

sudo iptables -A INPUT -p udp --dport 8472 -j DROP

nftables

sudo nft add rule inet filter input udp dport 8472 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block UDP 8472' -Direction Inbound -Protocol UDP -LocalPort 8472 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.