Port 9090: Prometheus

What uses port 9090

Prometheus serves its web UI, query API and remote-write receiver on 9090. It scrapes metrics from targets such as node_exporter (9100) and application /metrics endpoints, and sends alerts to Alertmanager on 9093. Cockpit, the Linux server admin UI, also uses 9090.

Should port 9090 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

• Prometheus has no built-in authentication by default. Use its web.config.file for basic auth and TLS, or put it behind a reverse proxy.

Check what is listening on port 9090

sudo ss -ltnp 'sport = :9090'

sudo lsof -nP -iTCP:9090 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 9090 -State Listen
netstat -ano | findstr :9090

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 9090

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:9090 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 9090 -State Listen).OwningProcess

Allow port 9090 from trusted networks only

The examples allow 9090 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 9090 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 9090 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="9090" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Prometheus 9090/TCP" -Direction Inbound -Protocol TCP -LocalPort 9090 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 9090 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 9090:9090 would expose the port to the whole network.
docker run -d -p 127.0.0.1:9090:9090 prom/prometheus

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 9090 from another machine

nc -zv example.com 9090

Test-NetConnection example.com -Port 9090

Related ports

• Port 9100 (Node exporter / printing): used by Prometheus node_exporter and by raw network printing (JetDirect).
• Port 9093 (Alertmanager / Kafka controller): used by Prometheus Alertmanager and often by Kafka KRaft controllers.
• Port 3000 (Development server / Grafana): the default port of many development servers and of Grafana.
• Port 4317 (OpenTelemetry (OTLP gRPC)): used by OpenTelemetry to send traces, metrics and logs over gRPC (OTLP).

More monitoring and logging ports

161 (SNMP) , 162 (SNMP traps) , 514 (Syslog) , 4318 (OpenTelemetry (OTLP HTTP)) , 5601 (Kibana) . See all ports in the port lookup.

Sources

• IANA port registry (not registered for this use)

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions