Cloudera Docs

Ports Used by Cloudera Runtime Components

Cloudera Runtime components use a number of ports for associated services.

All ports listed are TCP.

In the following tables, Internal means that the port is used only for communication among the components; External means that the port can be used for either internal or external communication.

Table 1. External Ports
Component Service Port Configuration Comment
Apache Atlas Non-SSL 31000 atlas.server.http.port
SSL 31443 atlas.server.https.port This port is used only when Atlas is in SSL mode.
Apache Hadoop HDFS DataNode 9866 dfs.datanode.address DataNode server address and port for data transfer.
9864 dfs.datanode.http.address DataNode HTTP server port.
9865 dfs.datanode.https.address DataNode HTTPS server port.
9867 dfs.datanode.ipc.address DataNode IPC server port.
NameNode 8020 fs.default.name or fs.defaultFS

fs.default.name is deprecated (but still works)
8022 dfs.namenode.servicerpc-address

Optional port used by HDFS daemons to avoid sharing the RPC port used by clients (8020). Cloudera recommends using port 8022.
9870 dfs.http.address or dfs.namenode.http-address

dfs.http.address is deprecated (but still works)
9871 dfs.https.address or dfs.namenode.https-address

dfs.https.address is deprecated (but still works)
NFS gateway 2049

nfs port (nfs3.server.port) 
4242

mountd port (nfs3.mountd.port) 

111

portmapper or rpcbind port.
50079 nfs.http.port The NFS gateway daemon uses this port to serve metrics. The port is configurable on versions 5.10 and higher.
50579 nfs.https.port The NFS gateway daemon uses this port to serve metrics. The port is configurable on versions 5.10 and higher.
HttpFS 14000 HttpFS server port
14001 HttpFS admin port
Secondary NameNode 9868 dfs.namenode.secondary.http-address The HTTP server address and port for the Secondary NameNode's web UI.
9869 dfs.namenode.secondary.https-address The secure HTTPS server address and port for encrypted web UI access.
JournalNode 8480 dfs.journalnode.http-address The HTTP server address and port for the JournalNode web UI.
8481 dfs.journalnode.https-address The secure HTTPS server address and port for encrypted web UI access.
8485 dfs.journalnode.rpc-address The RPC server address and port that Active and Standby NameNodes use to communicate with the JournalNode to read and write edit logs in High Availability (HA) configurations.
ZKFailoverController 8019 dfs.ha.zkfc.port The IPC/RPC port used by the ZooKeeper Failover Controller (ZKFC) daemon to manage health checks and trigger automatic failovers between NameNodes in High Availability setups.
Apache Hadoop YARN (MRv2) ResourceManager 8032 yarn.resourcemanager.address ResourceManager listens for client RPC traffic (default 8032). Clients use it to submit, kill, and monitor YARN applications via the ApplicationClientProtocol. It is the main entry point for users and tools (like yarn jar or the YARN client API) to talk to the RM, not for NodeManagers or ApplicationMasters.
8033 yarn.resourcemanager.admin.address ResourceManager listens for administrative RPC traffic (default 8033). Cluster admins use it for RM admin commands such as refreshing queues, nodes, or user/group mappings, and for HA operations like checking or changing active/standby state via yarn rmadmin. It is meant for privileged cluster management, not for normal job submission or container scheduling.
8088 yarn.resourcemanager.webapp.address ResourceManager serves its web UI over HTTP (default 8088). Users and admins use it in a browser to view cluster status, applications, queues, nodes, and logs without going through the RPC client port. It is for monitoring and troubleshooting, not for submitting jobs or for NodeManager/ApplicationMaster internal RPC communication.
8090 yarn.resourcemanager.webapp.https.address ResourceManager serves its web UI over HTTPS (default 8090). It provides the same monitoring pages as the HTTP webapp, but with encrypted browser traffic when TLS is enabled. You use it when yarn.http.policy is set to HTTPS_ONLY or when you want secure access to the RM UI instead of plain HTTP on port 8088.
NodeManager 8042 yarn.nodemanager.webapp.address NodeManager serves its web UI over HTTP (default 8042). Users and admins use it in a browser to view node status, running containers, and container logs on that specific host. It is for monitoring and troubleshooting, not for RM-to-NM RPC or container lifecycle management.
8044 yarn.nodemanager.webapp.https.address NodeManager serves its web UI over HTTPS (default 8044). It provides the same monitoring pages as the HTTP webapp, but with encrypted browser traffic when TLS is enabled. You use it when yarn.http.policy is set to HTTPS_ONLY or when you want secure access to the NM UI instead of plain HTTP on port 8042.
JobHistory Server 19888 mapreduce.jobhistory.webapp.address MapReduce Job History Server serves its web UI over HTTP (default 19888). Users and admins use it in a browser to view finished MapReduce jobs, task details, counters, and links to container logs.
19890 mapreduce.jobhistory.webapp.https.address MapReduce Job History Server serves its web UI over HTTPS (default 19890). It provides the same job history pages as the HTTP webapp, but with encrypted browser traffic when TLS is enabled.
Apache HBase Master 16000 hbase.master.port IPC
16010 hbase.master.info.port HTTP
RegionServer 16020 hbase.regionserver.port IPC
16030 hbase.regionserver.info.port HTTP

REST

 20550 hbase.rest.port The default REST port in HBase is 8080. Because this is a commonly used port, Cloudera Manager sets the default to 20550 instead.

REST UI

 8085 hbase.rest.info.port
HBase Thrift Server 9090 hbase.regionserver.thrift.port
HBase Thrift Serve Web UIr 9095
Lily HBase Indexer 11060
Apache Hive Metastore 9083
HiveServer2 10000 hive.server2.thrift.port

The Beeline command interpreter requires that you specify this port on the command line.

If you use Oracle database, you must manually reserve this port.
HiveServer2 Web User Interface (UI) 10002

hive.server2.webui.port in hive-site.xml
Hue Server 8888
Load Balancer 8889
Apache Impala Impala Daemon 21000 Used to transmit commands and receive results by impala-shell and version 1.2 of the Cloudera ODBC driver.
21050 Used to transmit commands and receive results by applications, such as Business Intelligence tools, using JDBC, the Beeswax query editor in Hue, and version 2.0 or higher of the Cloudera ODBC driver.
25000 Impala web interface for administrators to monitor and troubleshoot.
28000 Used to transmit commands and receive results by client applications over HTTP through the HiveServer2 protocol.
StateStore Daemon 25010 StateStore web interface for administrators to monitor and troubleshoot.
Catalog Daemon 25020 Catalog service web interface for administrators to monitor and troubleshoot.
Apache Kafka Kafka Broker 9092 port The primary communication port used by producers and consumers; also used for inter-broker communication.
9093 ssl_port A secured communication port used by producers and consumers; also used for inter-broker communication.
24042 kafka.http.metrics.port The port that the HTTP metric reporter listens on.
9393 jmx_port Port for JMX.
KRaft Controller 9192 port KRaft server port.
9193 ssl_port KRaft server secure port.
24043 kafka.http.metrics.port The port that the HTTP metric reporter listens on.
9395 jmx_port Port for JMX.
Kafka Connect 28083 rest.port Kafka Connect Rest Port.
28085 secure.rest.port Kafka Connect Secure Rest Port
28084 metrics.jetty.server.port Jetty Metrics Port
28087 metrics.jetty.server.secureport Secure Jetty Metrics Port
Apache Knox Knox Gateway 8443 gateway.port The HTTPS port for the Gateway
Knox Gateway (HTTPS) 8444 idbroker_gateway_port
Apache Kudu Master 7051 Kudu Master RPC port.
8051 Kudu Master HTTP server port.
TabletServer 7050 Kudu TabletServer RPC port.
8050 Kudu TabletServer HTTP server port.
Apache Oozie Oozie Server 11443 oozie_https_port HTTPS
Apache Ozone Ozone Manager 9862 ozone.om.rpc-port RPC endpoint for clients and applications.
9874 ozone.om.http-port HTTP port for the Ozone Manager web UI.
9875 ozone.om.https-port HTTPS port for the Ozone Manager web UI.
Storage Container Manager 9876 ozone.scm.http-port HTTP port for the SCM UI.
9877 ozone.scm.https-port HTTPS port for the SCM web UI.
DataNode 9882 hdds.datanode.http-address HTTP port for the DataNode web UI.
9883 hdds.datanode.https-address HTTPS port for the DataNode web UI.
9858 dfs.container.ratis.ipc RAFT server endpoint that is used by clients and other DataNodes to replicate RAFT transactions and write data.
9859 dfs.container.ipc Endpoint that is used by clients and other DataNodes to read block data.
S3 Gateway 9878 ozone.s3g.http-port HTTP port for the S3 API REST endpoint and web UI.
9879 ozone.s3g.https-port HTTPS port for the S3 API REST endpoint and web UI.
Recon Service 9891 ozone.recon.rpc-port Port used by DataNodes to communicate with the Recon Server.
9888 ozone.recon.http-port HTTP port for the Recon service web UI and REST API.
9889 ozone.recon.https-port HTTPS port for the Recon service web UI and REST API.
HttpFS 9778 httpfs.http.port The TCP port on which the Ozone HttpFS gateway listens to handle incoming WebHDFS REST API requests.
Apache Ranger Non-SSL 6080 ranger.service.http.port
SSL 6182 ranger.service.https.port This port is used only when Ranger is in SSL mode.
Admin Unix Auth Service Port 5151 ranger.unixauth.service.port
Usersync HTTP Port 8280 ranger.usersync.service.http.port HTTP port for Ranger Usersync
Usersync HTTPS Port 8283 ranger.usersync.service.https.port HTTPS port for Ranger Usersync
Tagsync HTTP Port 8180 ranger.tagsync.service.http.port HTTP port for Ranger Tagsync
Tagsync HTTPS Port Port 8183 ranger.tagsync.service.https.port HTTPS port for Ranger Tagsync
Ranger KMS Ranger KMS nodes 9292 ranger.service.http.port HTTP port for Ranger KMS.
Ranger KMS nodes 9494 ranger.service.https.port HTTPS port for Ranger KMS. Only used when SSL is enabled for Ranger KMS.
Ranger RMS Ranger RMS nodes 8383 ranger-rms.service.http.port HTTP port for Ranger RMS.
Ranger RMS nodes 8484 ranger-rms.service.https.port HTTPS port for Ranger RMS. Only used when SSL is enabled for Ranger RMS.
Apache Solr Solr Server 8983 HTTP port for all Solr-specific actions, update/query.
Solr Server 8985 HTTPS port for all Solr-specific actions, update/query.
Apache Spark

Shuffle service

 7337 spark.shuffle.service.port Port on which the Spark external shuffle service runs.

History Server

 18088 spark.history.ui.port HTTP port for the Spark History Server WebUI.

History Server with TLS

 18488 spark.ssl.historyServer.port HTTPS port for Spark History Server WebUI. Only used when SSL is enabled for Spark History Server.
Apache Sqoop

Metastore

 16000 sqoop.metastore.server.port
Apache Zeppelin Zeppelin Server 8885 zeppelin.server.port
Zeppelin Server (SSL) 8886 zeppelin.server.ssl.port
Apache ZooKeeper

Server (with Cloudera Runtime or Cloudera Manager)

 2181 clientPort Client port.
Server (with Cloudera Runtime or Cloudera Manager) (SSL) 2182 secureClientPort Secure client port.
Cruise Control Cruise Control Server 8899 webserver.http.port This is the main port that enables access to the Cruise Control Server
Livy Livy Server Web UI 8998 livy.server.port
Livy Thrift Server 10090 livy.server.thrift.port
Omid TSO Server 54758
Schema Registry Schema Registry Server 7788 schema.registry.port REST endpoint for Schema Registry.
7790 schema.registry.ssl.port When SSL is enabled, REST endpoint for Schema Registry.
Streams Messaging Manager Streams Messaging Manager Rest Admin Server 8585 streams.messaging.manager.port Streams Messaging Manager Port
8587 streams.messaging.manager.ssl.port Streams Messaging Manager Port (SSL)
Streams Messaging Manager UI Server 9991 streams.messaging.manager.ui.port The port on which server accepts connections. This port is used for both secured and unsecured connections.
Streams Replication Manager SRM Service 6670 streams.replication.manager.service.port SRM Service port.
6671 streams.replication.manager.service.ssl.port SRM Service port when SSL is enabled.
SRM Driver 38083 rest.port The port that the REST API listens on for connection requests. This port is used by SRM Driver if TLS/SSL is disabled.
38085 secure.rest.port The secure port that the REST API listens on for connection requests. This port is used by SRM Driver if TLS/SSL is enabled.
26001 metrics.jetty.server.port The port that the HTTP metrics reporter listens on.
26002 metrics.jetty.server.secureport The port that the HTTPS metrics reporter listens on.
SRM Service 6672 streams.replication.manager.service.metric.port SRM Service Metrics port.
6673 streams.replication.manager.service.metric.ssl.port SRM Service Metrics https port.
Table 2. Internal Ports
Component Service Port Configuration Comment
Apache Hadoop HDFS Secondary NameNode 9868 dfs.secondary.http.address or dfs.namenode.secondary.http-address

dfs.secondary.http.addressis deprecated (but still works)
9869 dfs.secondary.https.address
JournalNode 8485 dfs.journalnode.rpc-address
8480

dfs.journalnode.http-address

8481

dfs.journalnode.https-address

Failover Controller

 8019

Used for NameNode HA
Apache Hadoop YARN (MRv2) ResourceManager 8030 yarn.resourcemanager.scheduler.address ResourceManager listens for ApplicationMaster RPC traffic (default 8030). ApplicationMasters use it to register, send heartbeats, and request or release containers from the scheduler. It is the main internal link between running applications and the RM’s scheduling logic for allocating cluster resources.
8031 yarn.resourcemanager.resource-tracker.address ResourceManager listens for NodeManager RPC traffic (default 8031). NodeManagers use it to register with the RM, send heartbeats, report container status, and receive container start/stop commands. It is the main internal link between the RM and NMs for tracking cluster nodes and the containers running on them.
NodeManager 8040 yarn.nodemanager.localizer.address NodeManager runs its localizer service (default 8040). The localizer downloads job resources (jars, files, splits) from HDFS or other storage onto the node’s local disk before containers start. It is internal NM infrastructure for staging application data, not for users, the RM web UI, or normal container RPC on yarn.nodemanager.address.
8041 yarn.nodemanager.address NodeManager listens for ContainerManager RPC traffic. The ResourceManager, ApplicationMasters, and containers use it to start/stop containers, report status, and manage lifecycle on that node.
JobHistory Server 10020 mapreduce.jobhistory.address MapReduce Job History Server listens for RPC/API traffic (default 10020). MapReduce ApplicationMasters and clients use it to publish and query job history events and metadata for completed or running MR jobs.
10033 mapreduce.jobhistory.admin.address MapReduce Job History Server listens for administrative RPC traffic (default 10033). Cluster admins use it for privileged JHS operations such as refreshing ACLs and other admin protocol commands.

Shuffle HTTP

 13562 mapreduce.shuffle.port NodeManager’s MapReduce shuffle aux service (ShuffleHandler) listens (default 13562). After map tasks finish, reduce tasks connect to this port on the node that ran the map to fetch intermediate map output data over HTTP.
Queue Manager 8082 queuemanager_webapp_port Port 8082 is the default HTTP port for the Queue Manager backend in this project. It serves both the REST API and the Queue Manager web UI.
Config Store/Service 8080 config_service_application_connector_port Port 8080 is the main Config Service REST API for namespaces, config sets, configs, and related operations.
Queue Manager Config-Service 8081 config_service_admin_connector_port Admin interface for ops endpoints like health checks and metrics, not the business API.
Apache HBase HQuorumPeer 2181 hbase.zookeeper.property.clientPort

HBase-managed ZooKeeper mode
2888 hbase.zookeeper.peerport

HBase-managed ZooKeeper mode
3888 hbase.zookeeper.leaderport

HBase-managed ZooKeeper mode
Apache Impala Impala Daemon 23000 Internal use only. Impala daemons listen on this port for updates from the statestore daemon.
27000 Internal use only. Impala daemons use this port for KRPC based communication with each other.
StateStore Daemon 24000 Internal use only. The statestore daemon listens on this port for registration/unregistration requests.
Catalog Daemon 23020 Internal use only. The catalog daemon listens on this port for updates from the statestore daemon.
26000 Internal use only. The catalog service uses this port to communicate with the Impala daemons.
Apache Kafka Kafka Broker 9092 port The primary communication port used by producers and consumers; also used for inter-broker communication.
9093 ssl_port A secured communication port used by producers and consumers; also used for inter-broker communication.
9393 jmx_port Internal use only. Used for administration via JMX.
9394 kafka.http.metrics.port Internal use only. This is the port via which the HTTP metric reporter listens. It is used to retrieve metrics through HTTP instead of JMX.
Kafka MirrorMaker 24042 jmx_port Internal use only. Used to administer the producer and consumer of the MirrorMaker.
Apache Ozone Ozone Manager 9872 ozone.om.ratis-port RPC endpoint for Ozone Manager HA instances to form a RAFT consensus ring.
Storage Container Manager 9861 ozone.scm.datanode.port Port used by the DataNodes to communicate with the Storage Container Manager (SCM).
9863 ozone.scm.block.client.port Port used by the Ozone Manager to communicate with the SCM for block related operations.
9860 ozone.scm.client.port Port used by the Ozone Manager and other clients to communicate with the SCM for container operations.
9894 ozone.scm.ratis.port Port used by the SCM to communicate with other SCMs using Ratis.
9895 ozone.scm.grpc.port Port used by the SCM to communicate with other SCMs about the database checkpoint downloads.
Apache Phoenix Phoenix Query Server Port 8765 phoenix.queryserver.http.port
Apache Solr Solr Server 8993 Infra-Solr HTTP port
Solr Server 8995 Infra-Solr HTTPS port
Apache ZooKeeper

Server (with Cloudera Runtime only)

 2888 X in server.N =host:X:Y Peer

Server (with Cloudera Runtime only)

 3888 X in server.N =host:X:Y Peer

Server (with Cloudera Runtime and Cloudera Manager)

 3181 X in server.N =host:X:Y Peer

Server (with Cloudera Runtime and Cloudera Manager)

 4181 X in server.N =host:X:Y Peer
ZooKeeper JMX port 9010 ZooKeeper will also use another randomly selected port for RMI. To allow Cloudera Manager to monitor ZooKeeper, you must do one of the following:
  • Open up all ports when the connection originates from the Cloudera Manager Server
  • Do the following:
    1. Open a non-ephemeral port (such as 9011) in the firewall.
    2. Install Oracle Java 7u4 JDK or higher.
    3. Add the port configuration to the advanced configuration snippet, for example: -Dcom.sun.management.jmxremote.rmi.port=9011
    4. Restart ZooKeeper.