Port 27017: MongoDB — The Humongous Database

Port 27017 is the default port for MongoDB, the document-oriented database that helped spark the NoSQL revolution. When you connect to a MongoDB instance, you're typically knocking on this door. Behind it lies a database designed for one thing: scale that traditional relational databases couldn't handle.

What Runs on Port 27017

MongoDB's wire protocol operates over TCP on port 27017 by default.¹ Clients, from application servers to command-line tools, connect here to read and write documents. The protocol is straightforward: a request-response pattern where clients send commands encoded in BSON (Binary JSON), and the server responds in kind.²

Unlike SQL databases that speak a textual query language, MongoDB communicates in a binary format optimized for document structures. Every query, every insert, every aggregation pipeline flows through this port as BSON-encoded messages, each prefixed with length fields that let the server parse them efficiently without reading character by character.³

The Mechanism: Documents All the Way Down

The key insight of MongoDB is deceptively simple: store data the way applications actually use it.

In a relational database, a user's profile might be scattered across five tables, connected by foreign keys, requiring joins to reassemble. In MongoDB, that profile is a single document, a nested structure that looks remarkably like a JSON object. Everything you need, stored together, retrieved together.⁴

BSON, MongoDB's binary format, extends JSON with additional types: proper dates, binary data, 64-bit integers, decimal128 for financial calculations. It's JSON that grew up and got a job.⁵ The wire protocol wraps BSON documents in a simple envelope, the OP_MSG opcode, which handles everything from simple queries to complex aggregation pipelines.⁶

The protocol supports compression (zlib, snappy, zstd), which means the BSON flying through port 27017 can be squeezed down for networks that need it.⁷

The Origin Story: When Ads Broke Databases

In the early 2000s, Dwight Merriman was CTO of DoubleClick, the online advertising company that would later be acquired by Google. The problem DoubleClick faced was unprecedented: serving more than 400,000 ads per second.⁸

Relational databases buckled. The team tried everything, including putting Memcached farms in front of databases to absorb the load. But cached data goes stale. The guarantees you expect from a database, that the data is current and consistent, evaporate when you're reading from a cache that might be seconds or minutes behind reality.⁹

After DoubleClick sold for $1.1 billion in 2005, Merriman stepped down. In 2007, he reunited with Eliot Horowitz and Kevin Ryan to build something new.¹⁰ They started a company called 10gen, initially aiming to create a platform-as-a-service. But the database layer they built underneath it turned out to be the real innovation.

That internal database, nicknamed after the word "humongous," became MongoDB. The first public release came in 2009, open-source from the start.¹¹

Merriman later described it as "creating what I wished I had at DoubleClick: a database for the way we write code today; that scales; that works in an iterative environment; that works with semi-structured, unstructured, and polymorphic data, elegantly."¹²

Why 27017?

The specific choice of port 27017 has no dramatic origin story. It's a practical selection: high enough to avoid conflicts with well-known system services (which occupy ports below 1024), and not already claimed by another major application.¹³

The number became convention through widespread adoption. MongoDB's companion ports follow a logical sequence: 27018 for shard servers, 27019 for config servers in a sharded cluster.¹⁴

The 2017 Apocalypse

In January 2017, something catastrophic happened on port 27017.

Automated scripts began scanning the entire Internet, looking for MongoDB instances listening on port 27017. When they found one without authentication enabled, they connected, deleted all the data, and left behind a single database containing a ransom note demanding Bitcoin.¹⁵

Within days, over 27,000 databases were wiped.¹⁶ By the end of the wave, the number exceeded 45,000.¹⁷

The root cause was configuration that prioritized convenience over security. On some systems, MongoDB's default installation listened on publicly accessible ports with no access control or authentication.¹⁸ Users were supposed to read the documentation and configure security after installation. Many didn't.

The Shodan search engine made finding these exposed databases trivially easy. Simple queries revealed tens of thousands of MongoDB instances sitting open on the Internet, waiting to be plundered.¹⁹

The attacks were automated and indiscriminate. There was no sophistication required, no exploit of a software vulnerability. Just the assumption, correct tens of thousands of times, that people would deploy databases without reading the manual.

Security: An Ongoing Story

The 2017 ransomware wave was a wake-up call, but security incidents continued.

In December 2023, MongoDB disclosed a data breach affecting its corporate systems, caused by exposed database configurations.²⁰

In late 2025, a new vulnerability called MongoBleed (CVE-2025-14847) emerged. It exploited the Zlib compression protocol, allowing attackers to read uninitialized heap memory without authentication. Over 200,000 MongoDB instances worldwide were found vulnerable.²¹ Ransomware groups immediately automated exploitation.²²

The lesson repeats: MongoDB's power and flexibility demand careful configuration. The database that's easy to deploy is also easy to deploy insecurely.

Current Relevance

MongoDB now powers applications at companies ranging from startups to enterprises. As of 2025, over 28,000 verified companies use MongoDB, with estimates ranging much higher.²³ It holds roughly 45% of the NoSQL database market and about 7% of the overall database management system market.²⁴

The company went public in October 2017, just months after the ransomware wave that made its security defaults infamous.²⁵ Today, MongoDB Inc. reports over $2 billion in annual revenue, though profitability remains elusive.²⁶

MongoDB is particularly dominant in modern application development, where document models align naturally with object-oriented programming and JSON-centric APIs. Information technology, software development, and machine learning workloads are its largest customer segments.²⁷

Related Ports