Port 8009Apache JServ Protocol (AJP)
Port 8009 is primarily used by the Apache JServ Protocol (AJP), which facilitates communication between web servers like Apache HTTP and servlet containers such as Apache Tomcat. It enables the passing of requests and responses efficiently and is commonly used for load balancing and proxying dynamic content. As a binary protocol, AJP is faster than traditional HTTP forwarding, but improper configuration may expose applications to security risks..
- transport
- tcp
- in transit
- cleartext
- assignment
- unofficial
- risk
- 5/10
- lookups
- 15,834
single transport
payload readable on path
used by convention
caution
rank 190 of 993 · top 19%
Technical Details
what runs on :8009Apache JServ Protocol (AJP), generally operating over port 8009, is a binary protocol designed to efficiently bridge between web servers (like Apache HTTP Server) and Java application servers such as Apache Tomcat.
AJP optimizes request forwarding by reducing overhead compared to HTTP proxying. It handles connection reuse, persistent connections, and supports SSL information forwarding. The protocol tunnels requests from the HTTP server to Tomcat, where servlets process them. Responses are then returned via the same route.
In typical use, the Apache mod_jk or mod_proxy_ajp module communicates with Tomcat over AJP. Configurations often place this behind a firewall or restrict it to localhost communications due to low protocol-level security features. Recent versions of Tomcat provide options to further secure AJP, recognizing emerging threats tied to its exposure.
Security Information
exposure of :8009risk score
5/ 10caution
worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.
web services averages 3.9 across 112 ports — this one sits 1.1 above.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
unofficial
used by convention, not registered — what answers here varies by deployment
reachable over
tcp
every listening transport is another surface to filter at the edge
security overview
Common Vulnerabilities:
- AJP suffers from insecure default configurations, which historically allowed wide-open access if not properly restricted.
- Vulnerable to request smuggling and information disclosure attacks if accessible externally.
- The 'Ghostcat' vulnerability (CVE-2020-1938) permits attackers to read arbitrary files or execute code through unauthenticated AJP connections.
Common Mitigations:
- Bind AJP listeners only to localhost or internal interfaces to avoid public exposure.
- Use network-level controls (firewalls) to restrict access to port 8009.
- Configure authentication and strong secret sharing where supported with recent Apache Tomcat versions.
- Disable the AJP connector if not required.
- Regularly update servlet containers and related libraries to address known vulnerabilities.
Related Ports
the 8 most looked-up other ports in web services — 112 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8888 | Sun Answerbook & Alt HTTP | TCP | Web Services | caution | 123.9k |
| :8000 | Intel Remote Desktop / Alternate HTTP Port | TCP | Web Services | safe | 84.3k |
| :8888 | NewsEDGE | TCPUDP | Web Services | caution | 83.3k |
| :8888 | HTTP Alternative Port | TCP | Web Services | caution | 76.5k |
| :8888 | GNUmp3d Streaming HTTP | TCP | Web Services | caution | 76.3k |
| :9080 | Groove RPC | TCPUDP | Web Services | caution | 70.8k |
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :80 | HTTP | TCPUDP | Web Services | caution | 67.3k |
risk mix of the 8 listed
- safe13%
- caution88%
0 of 8 encrypted