Port 9 DISCARD
Port 9 is the IANA-assigned discard port for Discard (TCP / UDP / SCTP / DCCP).
What is port 9 used for?
Port 9 is assigned to discard and uses TCP / UDP / SCTP / DCCP. The IANA registry describes the service as “Discard”. It sits in the well-known range, which operating systems reserve for core network services, so software expects it at this number by default.
Ports are the transport-layer address a service listens on. A client that wants to reach discard connects to port 9. A TCP connection is refused when nothing is listening, while a UDP request simply goes unanswered. That is why a port conflict appears whenever two processes try to bind the same number.
Use the commands below to confirm whether port 9 is actually in use before you change firewall rules. Blocking the port stops new inbound traffic at the firewall, but it does not stop a local process from listening, and it does not remove the service from the machine.
Source: IANA Service Name and Transport Protocol Port Number Registry. Registered assignee: [Jon_Postel]. Reference: [RFC 9260].
Check and block port 9
Copy-ready commands for the protocols assigned to this port. Run the check first, then block only what should not be reachable.
Check on Linux
sudo ss -tlpn 'sport = :9'
sudo ss -ulpn 'sport = :9'
sudo ss -Slpn 'sport = :9'
sudo ss -dlpn 'sport = :9'Check on Windows
Get-NetTCPConnection -LocalPort 9 -State Listen -ErrorAction SilentlyContinue
Get-NetUDPEndpoint -LocalPort 9 -ErrorAction SilentlyContinueBlock with UFW
sudo ufw deny 9/tcp
sudo ufw deny 9/udpBlock with iptables
sudo iptables -A INPUT -p tcp --dport 9 -j DROP
sudo iptables -A INPUT -p udp --dport 9 -j DROP
sudo iptables -A INPUT -p sctp --dport 9 -j DROP
sudo iptables -A INPUT -p dccp --dport 9 -j DROPThese commands are examples for a typical host. Check the listener before you change firewall rules, and persist iptables rules with iptables-save or netfilter-persistent. On Windows, use Windows Defender Firewall or New-NetFirewallRule for persistent blocks. The iptables rules here cover IPv4; mirror them with ip6tables if IPv6 is enabled. UFW and the built-in Windows cmdlets cover TCP and UDP only; this port also lists SCTP / DCCP, so use nftables, iptables or the vendor's diagnostic tool for those protocols. SCTP and DCCP handling also depends on kernel support, including their diagnostic modules, so a missing result may mean the module is not loaded rather than that nothing is listening.
Is port 9 safe to expose?
This port is not on our curated list of services with a widely exploited profile. Exposure is only safe when the listening service is intended, patched and protected by a firewall. Keep the listening service patched and remove it if unused. A default-deny firewall policy with explicit allow rules is still the safest baseline.
Where port 9 is usually used
Most traffic on port 9 falls into these scenarios. The demo below is a safe way to confirm the listener before you change anything.
- Core infrastructure that clients expect to find at its default number.
- Firewall reviews that baseline which classic services are reachable.
- Troubleshooting connectivity when an application assumes the standard port.
Probe the port
Confirm something is listening before you debug the client. Replace 127.0.0.1 with the host you are testing.
nc -vz 127.0.0.1 9Common problems with port 9
Connection refused or timed out
Refused usually means the host is reachable but nothing is listening on port 9. A timeout more often means a firewall drop, a wrong host or a service bound to a different interface.
Port already in use
Find the process holding the port with sudo ss -tlpn 'sport = :9' or sudo lsof -i :9. Stop that process or configure it to bind another port; killing it without identifying it can take down a production service.
Firewall rule did not survive a reboot
UFW and Windows Firewall keep rules across restarts. Raw iptables rules do not: save them with iptables-save or the netfilter-persistent package, and re-apply after upgrades that reset the ruleset.
The port is blocked but still reachable
A firewall rule filters inbound traffic; it does not close the listener. Confirm with the check command above and bind the service to 127.0.0.1 when only local clients need it.
Port 9 at a glance
| Port number | 9 |
|---|---|
| Service name | discard |
| Transport protocol | TCP / UDP / SCTP / DCCP |
| Category | Core network services |
| Range | Well-known port (0–1023) |
| Risk level | Standard/Low |
| Registered assignee | [Jon_Postel] |
| Reference | [RFC 9260] |
| Registry description | Discard |
| Source | IANA Service Name and Transport Protocol Port Number Registry |
Frequently asked questions
What is port 9 used for?
Port 9 (DISCARD) uses TCP / UDP / SCTP / DCCP. Discard.
How do I check if port 9 is open?
On Linux run `sudo ss -tlpn 'sport = :9'` and `sudo ss -ulpn 'sport = :9'` and `sudo ss -Slpn 'sport = :9'` and `sudo ss -dlpn 'sport = :9'`. On Windows run `Get-NetTCPConnection -LocalPort 9 -State Listen -ErrorAction SilentlyContinue` and `Get-NetUDPEndpoint -LocalPort 9 -ErrorAction SilentlyContinue` in PowerShell. If the port is open, the output shows a process listening on port 9; empty output usually means nothing is bound to it. UFW and the built-in Windows cmdlets cover TCP and UDP only; SCTP / DCCP needs nftables, iptables or the vendor's diagnostic tool.
How do I block port 9?
With UFW run `sudo ufw deny 9/tcp` and `sudo ufw deny 9/udp`. With iptables run `sudo iptables -A INPUT -p tcp --dport 9 -j DROP` and `sudo iptables -A INPUT -p udp --dport 9 -j DROP` and `sudo iptables -A INPUT -p sctp --dport 9 -j DROP` and `sudo iptables -A INPUT -p dccp --dport 9 -j DROP`. Persist the iptables rules with your distribution's netfilter-persistent or iptables-save tooling so they survive a reboot. UFW covers TCP and UDP only; use iptables or nftables for SCTP / DCCP.
Is port 9 safe to expose?
This port is not on our curated list of services with a widely exploited profile. Exposure is only safe when the listening service is intended, patched and protected by a firewall. Nevertheless, keep the listening service patched and remove it if unused. A default-deny firewall policy with explicit allow rules is still the safest baseline.
Related ports
Primary data: IANA Service Name and Transport Protocol Port Number Registry.
Last reviewed 2026-10-30 · Methodology · About · Privacy