Skip to content
Kafka Is Fun
ConnectingAll clients

Connection to node -1 (localhost/127.0.0.1:9092) could not be established. Node may not be available.

Checked against Kafka 4.2 · Oct 2026Community draft, not yet reviewed by a Kafka specialist

What it means

Before a client has fetched metadata, it knows only the addresses in bootstrap.servers, and the client gives those addresses negative node ids (-1, -2 and so on). So a message naming node -1 means a connection to a bootstrap address could not be opened. Brokers get their real ids from the metadata the client fetches after that first connection.

Quick answer

Check that a broker is listening on the address in bootstrap.servers, and that you can open a connection to it from the machine or container the client runs in. If the message names a real broker id instead, the first connection worked and the problem is advertised.listeners.

Likely causes, most common first

  1. Nothing is listening at that address, or the port is wrong

    How to confirm

    Test the connection from the same machine or container as the client. Inside a container, localhost is the container itself. kafka-broker-api-versions.sh retrieves broker version information through the Admin client, so it is a quick way to test whether a client can reach the broker.

    confirm
    # Linux and macOS
nc -vz localhost 9092

# Windows PowerShell
Test-NetConnection localhost -Port 9092

kafka-broker-api-versions.sh --bootstrap-server localhost:9092

    Fix

    Start the broker, or correct bootstrap.servers. The broker's listeners setting says which port it binds (the default is PLAINTEXT://:9092).

  2. The listener's security protocol does not match the client's

    How to confirm

    Each listener has a security protocol, defined in listener.security.protocol.map or by using the protocol name as the listener name. The client's security.protocol must be one of PLAINTEXT, SSL, SASL_PLAINTEXT or SASL_SSL, and it has to match the listener you connect to.

    Fix

    Set security.protocol on the client to match the listener, and use that listener's port. For certificate problems, see the TLS entry.

  3. A firewall, security group or DNS name blocks the path

    How to confirm

    The connection test fails from the client machine but works from the broker machine, or the name does not resolve from the client.

    Fix

    Open the port between client and broker, or correct the name.

  4. If the message names a real broker id: advertised.listeners is not reachable from the client

    How to confirm

    The documentation describes bootstrap.servers as the addresses used to establish the initial connection, from which the client discovers the full set of brokers. After that it uses the addresses the brokers publish. advertised.listeners holds those addresses; if it is not set, listeners is used, and 0.0.0.0 is not valid to advertise. A name that only resolves inside Docker or a VPC fails for clients outside it.

    confirm
    # server.properties: one listener for clients inside the network, one for clients outside
listeners=PLAINTEXT://:29092,PLAINTEXT_HOST://:9092
advertised.listeners=PLAINTEXT://kafka:29092,PLAINTEXT_HOST://localhost:9092
listener.security.protocol.map=PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT
inter.broker.listener.name=PLAINTEXT
# KRaft also needs controller.listener.names and its own listener

    Fix

    Advertise a name each kind of client can reach from where it runs, with a separate listener for clients inside and outside the network, as above. The apache/kafka image's guide describes exactly this pattern, and sets properties through environment variables by replacing . with _ and prefixing KAFKA_ (listeners becomes KAFKA_LISTENERS, advertised.listeners becomes KAFKA_ADVERTISED_LISTENERS).

Sources

Every claim above comes from these Apache pages, as of Kafka 4.2. If a page does not say it, this entry does not.

Was this helpful?

Report an issue (opens GitHub in a new tab)

Back to all errors