Port 8009 (AJP (Tomcat))

Apache JServ Protocol connector between a front web server (Apache httpd mod_jk/mod_proxy_ajp) and Tomcat.

Registered (user) port, 1024-49151 TCP Web Do not expose to the internet

What port 8009 is used for

Apache JServ Protocol connector between a front web server (Apache httpd mod_jk/mod_proxy_ajp) and Tomcat.

Security: should port 8009 be open?

Do not expose to the internet. Ghostcat (CVE-2020-1938) let anyone reaching 8009 read web app files and sometimes execute code. Disable the AJP connector if unused, bind it to localhost and set a secret.

IANA assignment

Service nameProtoDescriptionAssigneeReference

nvme-disc TCP NVMe over Fabrics Discovery Service NVM Express Inc -

Registry dates for this port: registered 2018-03-27.

Check what is listening on port 8009

Linux: is anything listening on TCP 8009?

sudo ss -tlnp 'sport = :8009'

Linux / macOS: which process owns the port

sudo lsof -nP -i :8009

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':8009 '

Windows (Command Prompt)

netstat -ano | findstr :8009

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 8009 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 8009

From Windows

Test-NetConnection HOST -Port 8009

Block port 8009 in the firewall

ufw

sudo ufw deny 8009/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 8009 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 8009 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 8009' -Direction Inbound -Protocol TCP -LocalPort 8009 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.