Internet-Security raven logo internet-security.com

TCP 8005

ProtocolTCP
Port8005
LabelsTomcat remote shutdown

Synopsis

  • Apache Tomcat uses TCP port 8005 as its default SHUTDOWN command port (the server stops when it receives the shutdown string), typically bound to localhost.
  • Software that bundles Tomcat often inherits this, including Atlassian Jira and Confluence distributions, Adobe ColdFusion (Tomcat-based versions), Apache TomEE, and Red Hat JBoss Web Server (Tomcat).
  • When misconfigured and exposed to the network, attackers have exploited port 8005 to remotely shut down Tomcat-based services by sending the shutdown string, causing denial of service; admins commonly disable it (port=-1) or bind it to 127.0.0.1 only.

Observed activity

Last 30 days Detailed chart

More information