Port 4789 supports Docker Swarm VXLAN and VXLAN (TCP reference coverage) across distinct transports. Review each protocol before writing firewall or monitoring policy.
Default VXLAN data path for Docker Swarm overlay networks.
Container traffic traversing between swarm nodes on overlay networks.
Cluster internal
Docker explicitly recommends limiting this unauthenticated VXLAN path to trusted networks and never opening it at the perimeter.
VXLAN (TCP reference coverage) is documented as a network service convention for port 4789 over TCP.
Use this reference entry when identifying or validating systems documented to use 4789/TCP.
Varies
Confirm the listening process and current vendor documentation before permitting traffic; a listed convention does not prove the active service or its security posture.