TCP 4369
Synopsis
- TCP port 4369 is used by the Erlang Port Mapper Daemon (epmd), which lets Erlang/OTP nodes discover each other for distributed operation. You will see it open on systems running Erlang-based software such as RabbitMQ (clustering), Apache CouchDB 2.x/3.x (cluster discovery), Riak KV, ejabberd/MongooseIM (XMPP servers), EMQX or VerneMQ (MQTT brokers), and Elixir/Phoenix releases when clustering. On Windows and Linux hosts with Erlang installed, epmd commonly runs as a small daemon listening on 4369. Security: attackers often scan for 4369 to find Erlang deployments; if epmd and the Erlang distribution are exposed and the shared cookie is weak/known, they can enumerate nodes via epmd and sometimes achieve remote code execution by joining the cluster as a peer.
Observed activity
Last 30 days
Detailed chart