TCP 8000
Synopsis
- Splunk Enterprise’s web interface listens on TCP port 8000 by default.
- Icecast streaming audio servers use port 8000 by default for listener and admin endpoints.
- SHOUTcast DNAS commonly serves internet radio streams on TCP 8000.
- Python’s http.server (SimpleHTTPServer), Django’s runserver, Uvicorn, and Gunicorn all default to port 8000 for their built-in/development HTTP servers.
- SAP NetWeaver Application Server (instance 00) exposes its ICM HTTP service on port 8000 (the 80NN scheme).
- Hikvision DVR/NVR/IP camera devices use TCP 8000 for their proprietary SDK/server service used by client software and mobile apps.
- Java remote debugging via JDWP is frequently configured to listen on 8000 in examples and real deployments.
- Port 8000 is often targeted by attackers because exposed dev servers and Hikvision services on 8000 have been widely scanned, brute-forced, and exploited in the wild.
Observed activity
Last 30 days
Detailed chart