Port reference
Port 8009 (TCP) – AJP (Apache JServ Protocol)
Binary AJP connector that lets a front-end web server proxy requests to a Tomcat backend.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on default Tomcat installs (AJP connector enabled). Meant for internal use, but historically bound to all interfaces and exposed.
What is port 8009 used for?
Port 8009 is the default for AJP (Apache JServ Protocol), the binary connector that lets a front-end web server such as Apache httpd or Nginx pass requests to an Apache Tomcat backend. It works alongside Tomcat's HTTP connector on 8080 and is meant strictly for internal server-to-server traffic, not direct browser access.
When would you open it?
You generally do not open 8009 between machines unless your reverse proxy and Tomcat run on separate hosts and must talk over AJP. Most setups keep it on localhost or a private network; never forward it to the internet.
Is it safe to open?
AJP trusts its front-end proxy and has a history of file-read and remote-code flaws (Ghostcat), so exposing it is dangerous; bind it to localhost or restrict it to your proxy hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :8009
nmap -p 8009 <target>netstat -ano | findstr :8009
Test-NetConnection <host> -Port 8009lsof -i :8009
nmap -p 8009 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 8009 to your device's local IP, internal port 8009, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 8009/tcpsudo firewall-cmd --permanent --add-port=8009/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8009 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 8009" -Direction Inbound -Protocol TCP -LocalPort 8009 -Action AllowSecurity & risks
Common attacks
- Ghostcat (CVE-2020-1938) arbitrary file read of webapp files
- Remote code execution by combining file upload with the AJP flaw
- Reading configuration and credentials from WEB-INF
- Scanning for exposed AJP connectors alongside 8080 web apps
Hardening
- Disable the AJP connector if you don't use a front-end proxy
- Bind AJP to localhost (address="127.0.0.1") and never expose it
- Set a requiredSecret on the connector and patch Tomcat
- Firewall 8009 to allowed reverse-proxy hosts only
- Audit WEB-INF contents for secrets
How to block this port
sudo ufw deny 8009/tcpsudo firewall-cmd --permanent --remove-port=8009/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 8009 -j DROPNew-NetFirewallRule -DisplayName "Block 8009" -Direction Inbound -Protocol TCP -LocalPort 8009 -Action Blocknmap snippet
nmap -p8009 --script ajp-methods,http-vuln-cve2020-1938 <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 8009 used for?
- It runs AJP (Apache JServ Protocol), the binary connector Tomcat uses to receive proxied requests from a front-end web server like Apache httpd or Nginx. It is intended for internal traffic only.
- What is Ghostcat (CVE-2020-1938)?
- Ghostcat is an AJP flaw that lets attackers read arbitrary files inside a Tomcat web app (such as WEB-INF) and, combined with file upload, achieve RCE. Disable or restrict the AJP connector and patch Tomcat.