Port 2003: Graphite Carbon — Where metrics come to be counted

What This Port Is

Port 2003 sits in the registered ports range (1024-49151). IANA assigns ports in this range to specific services upon application, but port 2003 has no official assignment. IANA's registry simply lists it as available.

In practice, it is anything but vacant.

The Unofficial Occupant: Graphite Carbon

Port 2003 is the default plaintext ingestion port for Carbon, the backend daemon of Graphite — one of the most widely deployed time-series monitoring systems ever built.

Graphite was written by Chris Davis at Orbitz in 2006 as a side project. It grew to handle 160,000 distinct metrics per minute on two production servers before Orbitz open-sourced it in 2008 under the Apache 2.0 license. Etsy, GitHub, and countless others built their monitoring stacks on top of it.¹

Carbon sits at the center of that stack, and it listens on port 2003.

How the Protocol Works

The Carbon plaintext protocol is remarkably simple. Each metric is a single line:

<metric.path> <value> <unix_timestamp>

A real example:

servers.web01.cpu.usage 42.3 1708300800

That's the entire protocol. No headers. No authentication. No framing. You can send metrics with netcat:

echo "servers.web01.cpu.usage 42.3 $(date +%s)" | nc graphite.example.com 2003

Carbon receives the line, translates it, and stores it in Whisper — Graphite's custom time-series database format. The web interface and query layer can then retrieve and graph it.²

The simplicity is intentional and also the limitation. For high-volume metric ingestion, Graphite's pickle protocol runs on port 2004, accepting batches of metrics serialized in Python's pickle format. Port 2004 is faster. Port 2003 is human-readable. Both remain in widespread use.³

Related Ports

What's Listening on Your Port 2003?

To see what process is bound to port 2003 on your system:

Linux/macOS:

# Show the process listening on port 2003
ss -tlnp | grep 2003

# Alternative
lsof -i :2003

Windows:

netstat -ano | findstr :2003

If you see carbon-cache or a Python process, it's almost certainly Graphite. If you see something else entirely, that's the nature of unassigned ports — anyone can use them for anything.

Why Unassigned Ports Matter

IANA's registered port range exists to prevent collisions — to ensure that port 443 means HTTPS everywhere and port 22 means SSH everywhere. When a port goes unassigned, the ecosystem fills the vacuum informally. Port 2003 became Graphite's by convention, not by authority.

This works surprisingly well until two applications that both want port 2003 end up on the same host. Then someone has to move. The lack of official assignment means the conflict resolution is social, not technical.

For monitoring infrastructure, port 2003 has become a de facto standard. You can configure Graphite to listen anywhere, but most deployments leave it on 2003 because that's what the documentation says, and what everyone expects.