9300 Elasticsearch-transport TCP
Reference for TCP port 9300, commonly associated with Elasticsearch-transport.
What it's for
Port 9300 is Elasticsearch's transport port, used for internal node-to-node communication within a cluster — replicating data across shards, coordinating cluster state, and handling internal administrative operations between nodes. It's distinct from port 9200, which is the client-facing HTTP API applications actually query.
Protocol basics
Transport traffic on 9300 uses Elasticsearch's own binary protocol, optimized for efficient internal cluster communication rather than general HTTP interoperability. Application clients and tools like Kibana never need to connect to 9300 directly — it exists purely for the cluster's own nodes to coordinate with each other. Because it carries genuine cluster data and coordination traffic, it should be restricted to the cluster's private network, with the same security posture (TLS, authentication where supported) applied as the client-facing port.