On This Page

Home / Edge/ Set Up Cribl Edge/Ports

Ports

Learn which ports need to be open for Cribl Edge and its integrations to function.

Cribl Edge requires certain ports to be open, and additional ports are needed if you intend to use specific integrations or options to work.

Leader
​

In a Distributed deployment, the following ports must be open on the Leader Node. Ensure that the Leader is reachable on those ports from all Edge Nodes.

Default PortProtocolPurposeDirection
9000HTTP/SCribl Edge UI.In
9000HTTP/SBootstrapping Fleets from Leader (on-prem).In
443HTTP/SBootstrapping Fleets from Leader (Cribl.Cloud).In
4200TCPHeartbeat/Metrics/Leader requests/notifications to clients (for example: live captures, teleporting, status updates, config bundle notifications, and so on).In
4200HTTP/SSoftware upgrade (via path, not CDN).In

Outpost
​

The following port is used by Cribl Outpost.

Default PortProtocolPurposeDirection
9000TCPCribl Outpost UI. Login is disabled, but the Health endpoint is available.In
4200TCPCommunication between the Outpost and the Leader.Out

Edge Nodes
​

The following ports are used by Edge Nodes.

Default PortProtocolPurposeDirection
9420TCPCribl Edge UI.In
9000HTTP/SCommunication with the Leader for bootstrapping (on-prem).Out
443HTTP/SCommunication with the Leader for bootstrapping (hybrid deployment), and with https://cdn.cribl.io to download configurations from CDN.Out
4200TCPHeartbeat/Metrics/Leader requests/notifications to clients (for example: live captures, teleporting, status updates, config bundle notifications, and so on).Out
4200HTTP/SConfig bundle downloads from the Leader.Out

Other Ports
​

Common Ports
​

Default PortProtocolPurposeDirection
53UDPDNS lookups.Out
389TCPLDAP Auth (non-TLS).Out
443HTTP/SOIDC Auth (TLS).Out
636TCPLDAP Auth (TLS).Out

Integrations and Apps
​

Integrations with specific services via Sources and Destinations or apps may require opening dedicated ports on Edge Nodes.

The defaults are listed below, but when configuring each Source or Destination you can choose another port.

Default PortProtocolPurposeDirection
162UDPSNMP Trap collection (non-TLS). The preconfigured SNMP Trap Source listens on port 9162.In
162UDPSNMP Trap Destination (non-TLS).Out
443HTTP/SCollection from and output to multiple HTTPS-based Sources and Destinations.In / Out
4317TCPCollection from OpenTelemetry.In
5986HTTP/SWindows Event Forwarder Source.In
8081TCPKafka Schema Registry.Out
8088TCPSplunk HEC input and output.In/Out
8089TCPSplunk Search.In
8125TCP/UDPOutput to StatsD, StatsD Extended, and Graphite (non-TLS).Out
9090TCPCollection/discovery from Prometheus Scraper.Out
9092TCPOutput to Confluent Cloud or Kafka, used when no port is provided.Out
9093TCPOutput to Azure Event Hubs.Out
9200HTTP/SElasticsearch API Source.In
9514TCP/UDPSyslog Source.In
9997TCPSplunk TCP Source.Out
10060TCPTCP (Raw) data.In
10070TCPTCP JSON data.In
10080TCPCollection from HTTP JSON Sources.In
10200HTTP/SCribl HTTP Destination.In
10300TCPCribl TCP Destination.In

Cribl.Cloud
​

Cribl.Cloud provides a set of ports linked to Sources enabled by default for your Workspace. To view them:

  1. From your Cribl.Cloud Organization’s top bar, select Products.
  2. Then from the sidebar, select Cribl > Workspace, and then Data Sources.

Additionally, Cribl.Cloud makes the 20000 - 20010 port range available for configuring other Sources.

Available PortsProtocolPurposeDirection
443TCPMapped to 10443 internally. Pre-configured for Amazon Data Firehose, but can be reused for other TCP-based services.In
20000 - 20010TCPAdditional Sources in Cribl.Cloud.In

Reusing Port 443 for Other Services
​

External port 443 is transparently mapped by the load balancer to internal port 10443 on the Worker Group. While this port is pre-configured for Amazon Data Firehose by default, you can reuse it for other TCP-based services that require port 443 (such as DocuSign).

To use port 443 for a different service:

  1. Configure a Source to listen on port 10443 internally.
  2. External clients connect to your Cribl.Cloud endpoint on port 443, which the load balancer routes to port 10443 on the Worker.

If you’re already using Amazon Data Firehose on this port, you can still receive data from other services by differentiating traffic using a pre-processing Pipeline. For example, check for the presence of __firehose* fields or inspect __headers to identify the data source.

No other custom ports can be opened for Cribl-managed Worker Groups in Cribl.Cloud beyond port 443 and ports 20000-20010.

Cribl Copilot Port
​

To use Cribl Copilot, your Cribl Edge deployment must be able to establish a connection to ai.cribl.cloud on port 443.