Port 3121: pcmk-remote — The Pacemaker's Long Reach

What Runs on Port 3121

Port 3121 is the default port for pacemaker_remote (pcmk-remote), a service that extends Linux high-availability (HA) clusters to remote and guest nodes.

The full name of the daemon is pacemaker_remote. IANA has registered this port under the service name pcmk-remote.¹

What Pacemaker Actually Does

Pacemaker is a cluster resource manager. Its job is to keep services running even when individual machines fail. If a database server dies, Pacemaker notices, stops pretending the node exists, and starts the database elsewhere — automatically, in seconds.

Traditional Pacemaker clusters run on top of Corosync, a messaging layer that handles cluster membership and communication. Every node in a Corosync cluster has to run the full cluster stack. That's fine when you control all your machines. It's a problem when you don't.

Enter pacemaker_remote.

What Port 3121 Makes Possible

pacemaker_remote is a lightweight daemon. It doesn't need Corosync. It doesn't need the full cluster stack. A machine running only pacemaker_remote can join a cluster as a remote node or a guest node (typically a virtual machine), managed like any other cluster member — starting resources, accepting failovers, reporting health — with the core cluster nodes connecting to it on port 3121.²

The connection is secured with TLS using a pre-shared key (PSK). Both sides — the cluster node and the remote node — must share the same private key before any communication happens.³

# The port is configurable via environment variable in /etc/sysconfig/pacemaker
PCMK_remote_port=3121

The Registered Port Range

Port 3121 sits in the registered port range (1024–49151). These ports aren't reserved for exclusive system use like the well-known ports below 1024 — but they're officially registered with IANA, meaning an organization submitted a request saying "this is what we use this port for."

Registered doesn't mean universal. You won't find pacemaker_remote on most machines. You'll find it on Linux servers running Red Hat, SUSE, or Ubuntu systems that are part of a high-availability infrastructure — databases that can't go down, web services with SLA requirements, anything where "the server died" can't be the end of the story.

What's Actually Listening Here

On a machine that doesn't run pacemaker_remote, nothing should be listening on port 3121. Check with:

# Linux
ss -tlnp | grep 3121

# macOS
lsof -i :3121

# Windows
netstat -ano | findstr :3121

If something unexpected is listening here on a system that has nothing to do with Linux HA clusters, investigate it.