Port 9090: Prometheus, Process Checks and Security
TCP port 9090 is commonly used by Prometheus, whose documented default web listen address is 0.0.0.0:9090. Other applications can also use 9090, and IANA registers the name WebSM for TCP/UDP 9090. Always identify the local listener instead of naming a service from the port alone.
Port 9090 at a glance
| Question | Answer |
|---|---|
| Common current use | Prometheus web UI, API and telemetry endpoint over TCP |
| Prometheus default | 0.0.0.0:9090, according to the official command-line reference |
| IANA registration | WebSM for TCP and UDP 9090 |
| Main risk | An unauthorised user reaching operational metrics, labels, targets or administrative endpoints |
Identify what owns port 9090
| System | Read-only check |
|---|---|
| Windows | Get-NetTCPConnection -LocalPort 9090 -State Listen |
| Linux | sudo ss -ltnp '( sport = :9090 )' |
| macOS/Linux | lsof -nP -iTCP:9090 -sTCP:LISTEN |
| Container host | Check published ports with the container runtime, then inspect the owning deployment/configuration |
Prometheus often reveals itself through its UI or HTTP headers, but the process, service unit or container definition is the authoritative local evidence. Check whether the socket binds to localhost, one private interface or all interfaces.
Connection troubleshooting
- On the host, request headers with
curl -I http://127.0.0.1:9090. - If local access fails, confirm the process is running, the configured
--web.listen-addressand application logs. - If local access works but remote access fails, inspect the bind address, host firewall, cloud security group, network ACL, container port publication and reverse proxy.
- If a proxy returns a gateway error, verify its upstream address and whether the application expects a URL prefix.
- Use
nmap -sV -p 9090 <host>only on systems you are authorised to test.
Secure a Prometheus or admin interface
The official Prometheus reference documents a wildcard listen default, so network policy is important. Restrict the endpoint to monitoring systems and administrators, or place it behind a protected proxy/private access layer. Use TLS and authentication appropriate to the deployment, keep Prometheus and exporters patched, and avoid publishing a metrics interface directly to the internet.
Review what labels, target URLs and operational metadata the interface reveals. Restrict write/admin capabilities separately where supported. A firewall allow rule should name the owner, required sources and a review date; “9090 is a monitoring port” is not sufficient justification.
Frequently asked questions
What is port 9090 used for?
It is commonly used by Prometheus for its web UI, API and telemetry endpoint, but other applications can use it. IANA’s registered service name for TCP/UDP 9090 is WebSM.
Is port 9090 TCP or UDP?
Prometheus uses TCP 9090 for HTTP. IANA has registrations for both TCP and UDP 9090, so confirm the actual process and transport on the device.
Why is Prometheus reachable on every interface?
The official Prometheus command reference documents 0.0.0.0:9090 as the default web listen address. Host and network controls must still determine who can reach it.
Should port 9090 be public?
Usually no. Restrict monitoring/admin interfaces to intended systems and users, use protected private access or a secured proxy, and verify authentication, TLS and patching.
Primary sources
Port registrations describe assigned names, not a guarantee about the process actually listening on a device. Confirm the local process and configuration before changing a firewall.
Related guides
Practise the diagnosis, not only the port number
Use an authorised lab to identify the listener, inspect packets and test the firewall path. Attila teaches these troubleshooting habits with networking and security labs in Ahmedabad.