Port 3000Node.js, React & Grafana default

What port 3000 is used for

Port 3000 spread through the JavaScript ecosystem from early Express tutorials and became the default that most Node.js tooling inherited. Today it is where you expect to find:

• Front-end dev servers: Create React App, Next.js (next dev), Remix, and many Vite-based templates (Vite itself defaults to 5173).
• Node.js back ends following framework examples.
• Grafana, whose web interface listens on 3000 by default.
• Gitea, the self-hosted Git service.
• Ruby on Rails in development.

Because so many tools share the default, "port 3000 is already in use" is one of the most common errors a web developer sees.

Registration versus practice

IANA has two registrations for 3000 (remoteware-cl and hbci), neither of which you are likely to meet. They are historical entries; the practical meaning of a 3000 listener is "some development server or Grafana".

Freeing port 3000 on Windows

netstat -ano | findstr :3000
taskkill /PID 12345 /F

Replace 12345 with the PID from the first command. If the listener belongs to a service you did not start (for example Grafana installed as a service), stop the service rather than killing the process. See the taskkill record.

Security considerations

• Hot-reload servers expose your source tree. Front-end dev servers serve unbundled source and sometimes environment variables. Keep them on localhost.
• Grafana and Gitea hold credentials and tokens. Run them behind a TLS-terminating reverse proxy and never with default admin passwords on a reachable network.
• Docker publishing on -p 3000:3000 opens the port on every host interface; prefer -p 127.0.0.1:3000:3000 for local work.

How to check port 3000

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :3000

A line in the LISTENING state means a local program has bound port 3000; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :3000 or lsof -i :3000.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 3000

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 3000. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Firewall considerations

Workstations need no inbound rule for 3000. A server hosting Grafana or Gitea should allow 3000 only from the reverse proxy on the same host, or from the management network, and publish the service on 443 instead.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 3000 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.