Port 9 discard / Wake-on-LAN · UDP

What runs on port 9

The discard service throws away everything sent to it (a network /dev/null). The number lives on for a different reason: Wake-on-LAN magic packets are conventionally sent as UDP broadcasts to port 9 (sometimes 7), because the destination machine is asleep and no port actually matters.

Software that uses it: Wake-on-LAN tools (wakeonlan, etherwake, router WoL pages)

Should port 9 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• For WoL across subnets, the router must forward directed broadcasts to UDP 9; most do not by default.

Check port 9

# on the host: is anything listening, and which process?
ss -lunp 'sport = :9'
sudo lsof -i :9

# from another machine: is it reachable?
nc -zuv host 9
sudo nmap -sU -p 9 host

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 9

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 9 proto udp
sudo ufw deny 9/udp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 udp dport 9 accept
nft add rule inet filter input udp dport 9 drop

# iptables (legacy)
iptables -A INPUT -p udp --dport 9 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 9 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=9 protocol=udp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 9" with no source is just "open".

Related ports

• 7 echo
• 13 daytime

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions