TCP 30000
Synopsis
- Kubernetes NodePort services use the 30000–32767 TCP range by default; in practice, many clusters expose services on TCP 30000 (e.g., tutorials often map an NGINX or the Kubernetes Dashboard service to NodePort 30000).
- OpenShift (built on Kubernetes) inherits the same NodePort range, so platform services or apps are commonly reachable on TCP 30000 in real deployments.
- FTP servers frequently configure their passive data port range starting at 30000; for example, vsftpd and ProFTPD often use pasv_min_port=30000, so PASV data connections can occur on TCP 30000.
- This port range (including 30000) has been targeted in scans, and exposed Kubernetes dashboards/services on NodePorts have been exploited in the wild for cluster compromise and cryptomining.
Observed activity
Last 30 days
Detailed chart