On This Page

Home / Stream/ Deploying Cribl Stream Software· Planning and Sizing·Ports

Ports

Cribl Stream requires certain ports to be open, and additional ports are needed if you intend to use specific integrations or options to work.

Leader
​

In a Distributed deployment, the following ports must be open on the Leader Node. Ensure that the Leader is reachable on those ports from all Workers.

Default PortProtocolPurposeDirection
9000HTTP/SCribl Stream UI.In
9000HTTP/SBootstrapping Worker Nodes from Leader (on-prem).In
443HTTP/SBootstrapping Worker Nodes from Leader (Cribl.Cloud).In
4200TCPHeartbeat/Metrics/Leader requests/notifications to clients (for example: live captures, teleporting, status updates, config bundle notifications, and so on).In
4200HTTP/SSoftware upgrade (via path, not CDN).In

If you want to use proxy for communication between Leader and Worker Nodes, use SOCKS proxy instead of HTTP/S. You need to use SOCKS proxy, because HTTP/S proxies typically don’t support raw TCP sockets that Leader-Worker communication uses.

Workers
​

The following ports are used by Worker Nodes.

Default PortProtocolPurposeDirection
9000TCPCribl Stream UI.In
9000HTTP/SCommunication with the Leader for bootstrapping (on-prem).Out
443HTTP/S(In Cribl.Cloud hybrid deployments) Communication with the Leader for bootstrapping, and with https://cdn.cribl.io to download configurations from CDN.Out
4200TCPHeartbeat/Metrics/Leader requests/notifications to clients (for example: live captures, teleporting, status updates, config bundle notifications, and so on).Out
4200HTTP/SConfig bundle downloads.Out

Other Ports
​

This section lists port allocations for specific transport protocols and other special purposes.

Common Ports
​

Default PortProtocolPurposeDirection
53UDPDNS lookups.Out
389TCPLDAP Auth (non-TLS).Out
443TCPOIDC Auth (TLS).Out
636TCPLDAP Auth (TLS).Out

Integrations and Apps
​

Integrations with specific services via Sources and Destinations or apps may require opening dedicated ports on Worker Nodes.

The defaults are listed below, but when configuring each Source or Destination you can choose another port.

Default PortProtocolPurposeDirection
162UDPSNMP Trap collection (non-TLS). The preconfigured SNMP Trap Source listens on port 9162.In
162UDPSNMP Trap Destination (non-TLS).Out
443HTTP/SCollection from and output to multiple HTTPS-based Sources and Destinations.In/Out
4317TCPCollection from OpenTelemetry.In
5986HTTP/SWindows Event Forwarder Source.In
8081TCPKafka Schema Registry.Out
8088TCPSplunk HEC input and output.In/Out
8089TCPSplunk Search.In
8125TCP/UDPOutput to StatsD, StatsD Extended, and Graphite (non-TLS).Out
9090TCPCollection/discovery from Prometheus Scraper.Out
9092TCPCollection from Confluent Cloud or Kafka, used when no port is provided.Out
9092TCPOutput to Confluent Cloud or Kafka, used when no port is provided.Out
9093TCPOutput to Azure Event Hubs.Out
9200HTTP/SElasticsearch API Source.In
9997TCPSplunk TCP Source.Out
10000Splunk to Cribl Stream data port (Cribl App for Splunk).In/Out
10070TCPTCP JSON data.In
10080TCPCollection from HTTP JSON Sources.In
10200HTTP/SCribl HTTP Destination.In
10300TCPCribl TCP Destination.In
10420| criblstream Splunk search command to Cribl Stream (Cribl App for Splunk).In/Out

Cribl.Cloud Ports
​

Cribl.Cloud provides a set of ports linked to Sources enabled by default for your Workspace. To view them:

  1. From your Cribl.Cloud Organization’s top bar, select Products.
  2. Then from the sidebar, select Cribl > Workspace, and then Data Sources.

Additionally, Cribl.Cloud makes the 20000 – 20010 port range available for configuring other Sources.

Available PortsProtocolPurposeDirection
20000 – 20010TCPAdditional Sources in Cribl.Cloud.In

No other ports can be opened for Cribl-managed Worker Groups in Cribl.Cloud.

Overriding Default Ports
​

You can override the Cribl Stream UI port (9000), as well as other settings, in the $CRIBL_HOME/local/cribl/cribl.yml configuration file.

The defaults are stored in $CRIBL_HOME/default/cribl/cribl.yml.