TCP Port 6379 – Redis (In-Memory Data Store)
Port 6379 is the default port for Redis, an open-source in-memory data store originally created by Salvatore Sanfilippo and first released in 2009. Redis stores data in RAM rather than on disk, which makes it extremely fast for the kinds of operations it supports: simple key-value lookups, counters, queues, leaderboards, session stores, and caches that sit between web applications and slower backend databases. The trade-off is that data lives only as long as the server is running, unless explicitly persisted to disk through Redis’s built-in snapshot or append-only log mechanisms.
Redis is one of the most widely deployed pieces of infrastructure software. It is the default cache layer for many Ruby on Rails, Django, Node.js, and similar web applications; the message broker behind background-job systems like Sidekiq, Celery, and Bull; and the session storage for many websites. The IANA assignment for port 6379 was registered by Sanfilippo himself in 2015, formally recognizing the port allocation that had been in use since Redis’s first release.
Redis acquired enterprise-scale features over time, and the project was later commercialized through Redis Labs (now Redis Inc.). The open-source server remains widely used, and managed Redis is offered by every major cloud provider, including Amazon ElastiCache, Azure Cache for Redis, and Google Cloud Memorystore.
In typical deployments, Redis runs on internal networks or in private cloud subnets, accepting connections only from authorized application servers. Outbound TCP/6379 from end-user devices is uncommon and usually indicates a database administration tool (RedisInsight, redis-cli) connecting directly to a server. Inbound TCP/6379 from the public internet is unusual in 2026 and is treated as a serious exposure.
About TCP Port 6379
The Internet Assigned Numbers Authority (IANA) registers port 6379 for redis. The IANA description reads: ‘An advanced key-value cache and store’.
Security Considerations
The defining security pattern for port 6379 is unauthenticated Redis instances exposed directly to the public internet, and the specific attack technique that exploits them. Earlier versions of Redis shipped with a default configuration that bound to all network interfaces and required no authentication for connections. Combined with the common practice of installing Redis on a cloud server with default settings, this resulted in a large population of internet-reachable Redis instances with no protection.
The signature attack against an exposed Redis instance is SSH key injection. All 3 IDS rules referencing port 6379 in our data target this specific technique. An attacker connects to the Redis instance, uses Redis’s built-in CONFIG SET command to change the working directory to the target user’s .ssh folder and the persistence filename to authorized_keys, then writes the attacker’s SSH public key as a Redis value, and finally triggers a SAVE. Redis writes the key into the user’s authorized_keys file, and the attacker logs in via SSH. This technique was widely publicized in a 2015 blog post by Sanfilippo himself, warning users about the risks of exposing Redis without authentication.
A series of ransom waves followed in 2017 and 2018, paralleling the contemporaneous MongoDB campaigns. Attackers scanned the internet for unauthenticated Redis instances, dumped the contents, deleted the data, and left ransom notes demanding cryptocurrency for restoration. The Redis project had already responded to the underlying exposure issue by introducing “protected mode” in Redis 3.2 (2016), which prevents external connections when no password is set and Redis is bound to all interfaces, but unpatched and misconfigured deployments remained vulnerable for years.
Common practice today is to require authentication for all Redis access, bind the server to localhost or to a private network interface only, never expose Redis directly to the public internet, use TLS for connections that traverse any network outside the host (Redis 6.0 added native TLS support in 2020), and keep the server patched. For new applications, managed Redis services from cloud providers are generally recommended because they handle network isolation, authentication, and TLS by default.
Inbound TCP/6379 from the public internet to any host is a strong indicator of either a serious misconfiguration or an active scan and warrants immediate investigation.
IDS Rule References
3 IDS / security rules reference TCP port 6379. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 2): attempted-admin (2), misc-attack (1).
Sample rule descriptions for TCP port 6379:
- ET SCAN Redis SSH Key Overwrite Probing
- ET EXPLOIT REDIS Attemted SSH Authorized Key Writing Attempt
- ET EXPLOIT REDIS Attempted SSH Key Upload
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry and Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range).