2,404,811 answers on port 2181 and 1,381,208 on port 9092: the difference between a coordinator and a broker

In September 2026, distributed data infrastructure scans revealed stark differences between Apache ZooKeeper coordination services and Apache Kafka brokers. Port 2181, ZooKeeper's client port, was queried 2,404,811 times, while port 9092, Kafka's broker port, registered 1,381,208 results. A third query for the Kafka service returned 73,000 hits.

The divergence between port counts and service counts stems from the fact that port responses indicate a service is listening, but not its software specifics or security measures. Consequently, many port answers likely belong to unrelated services or development containers. Of the 1,381,208 Kafka broker results, only 73,000 were confirmed as legitimate Kafka traffic, underscoring the prevalence of unsecured or improperly configured brokers.

ZooKeeper's lack of authentication permits any client to access its coordination state, while Kafka's lack of authentication allows clients to list topics, consume records, and even produce data, potentially affecting the entire data flow of an application. These findings highlight the importance of verifying port usage and authentication settings in distributed infrastructure.

Next steps include comparing port usage and service counts for owned ranges, checking for authentication and authorisation configurations, and repeating these queries to monitor for new deployments. This approach can help identify potential security vulnerabilities and ensure proper configuration of distributed systems.