Port 8009 · Apache AJP

Port 8009 is Apache AJP, TCP.

Apache JServ Protocol — used between Apache httpd and Tomcat. CVE-2020-1938 (Ghostcat) made this a high-profile vulnerability. Block externally.

Palo Alto

Create the service object for this port, then allow the App-ID on it. Restricting the rule to the port's service object keeps the rule working on a non-default port and stops the App-ID matching on other ports. Replace the placeholders with your own rule name and zones.

set service tcp-8009 protocol tcp port 8009

set rulebase security rules <rule-name> from <from-zone> to <to-zone> source any destination any application ajp13 service tcp-8009 action allow

Risk and exposure

Rated high risk. Services on this port are commonly targeted by attackers. Keep it off the internet, or put it behind a VPN or a strict source allow-list, and monitor access.

Check it

• Linux ss -tlnp | grep :8009
• PowerShell Test-NetConnection <host> -Port 8009
• nmap nmap -p 8009 <host>

Related ports

• 8080 HTTP Alternate
• 8161 ActiveMQ Console
• 7001 WebLogic HTTP
• 7443 WebLogic HTTPS

← Search all ports