Port 5601: Kibana

What uses port 5601

Kibana’s web interface for searching logs and building dashboards runs on 5601 and talks to Elasticsearch on 9200. OpenSearch Dashboards uses the same port. Kibana should require login (Elastic security is on by default since 8.0) and usually sits behind a reverse proxy with HTTPS.

Should port 5601 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

Check what is listening on port 5601

sudo ss -ltnp 'sport = :5601'

sudo lsof -nP -iTCP:5601 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 5601 -State Listen
netstat -ano | findstr :5601

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5601

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:5601 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5601 -State Listen).OwningProcess

Allow port 5601 from trusted networks only

The examples allow 5601 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 5601 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5601 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5601" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Kibana 5601/TCP" -Direction Inbound -Protocol TCP -LocalPort 5601 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 5601 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 5601:5601 would expose the port to the whole network.
docker run -d -p 127.0.0.1:5601:5601 kibana

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 5601 from another machine

nc -zv example.com 5601

Test-NetConnection example.com -Port 5601

Related ports

• Port 9200 (Elasticsearch / OpenSearch): the HTTP API port of Elasticsearch and OpenSearch.
• Port 9300 (Elasticsearch transport): used for communication between Elasticsearch nodes.

More monitoring and logging ports

161 (SNMP) , 162 (SNMP traps) , 514 (Syslog) , 4317 (OpenTelemetry (OTLP gRPC)) , 4318 (OpenTelemetry (OTLP HTTP)) , 9090 (Prometheus) , 9093 (Alertmanager / Kafka controller) , 9100 (Node exporter / printing) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions