Elasticsearch ports

All nodes in an Elasticsearch cluster form a full-mesh cluster, which means that every node that participates in an Elasticsearch cluster needs to talk to the every other nodes of the cluster, in a bi-directional way. So there are a lot of TCP connections opened in addition to the ones opened for the clients to bind to (i.e. the 9200 and 9300 ranges).

In addition to that, Elasticsearch has a concept of "channel". A channel is a specific set of TCP connections for performing a specific type of operation, such as "recovery", "bulk", "regular", "cluster state", "ping".

So without entering too much into the details, each node has 13 TCP connections to each other node and vice versa:

• 2 connections for recovery operations,
• 3 connections for bulk operations,
• 6 connections for regular operations (search, etc),
• 1 connection for cluster state operations and
• 1 connection for ping operations.

In a two-nodes cluster, that means 26 connections. In a three-nodes cluster, that means 39 TCP connections, etc.

To sum it up, that's the main reason why you're seeing so many opened TCP ports on your machine.