Skip to main content
protocols.pageprotocols.page
8008

Port 8008 – HTTP Alternate

TCP

Port 8008 is an IANA-registered HTTP alternate port used when 80 and 8080 are occupied. IBM HTTP Server, some proxy servers, and internal APIs use 8008. Google's internal services historically used port 8008. No inherent security difference from other HTTP ports – apply same TLS and access controls.

Port Number

8008

Protocol

TCP

Service

HTTP Alternative

Range

IANA Registered (1024–49151)

Description

Port 8008 is registered with IANA as an HTTP alternate port. It serves the same purpose as 8080 – an alternative when the standard port 80 is unavailable or reserved. Various internal services and microservices bind to 8008 when other common ports are taken. In Kubernetes environments, port 8008 is commonly used for health check endpoints, internal APIs, and sidecar proxy admin interfaces. It carries no special significance beyond being 'another HTTP port' – apply the same security practices as any HTTP service.

Security risks

  • 1Matrix Synapse default port: Synapse homeserver listens on 8008 for client-server API (unauthenticated federation requests, room directory listing). Exposed Synapse on 8008 without rate limiting enables user enumeration and room brute-forcing
  • 2No authentication convention: services on 8008 frequently lack auth (internal Kubernetes services assume network isolation). If NetworkPolicy is misconfigured, cluster-internal 8008 endpoints become accessible from compromised pods
  • 3Proxy bypass: WAF/auth rules configured for port 443 may not cover 8008. Direct access to the backend on 8008 bypasses all front-door security controls. Bind internal services to pod IP only, not 0.0.0.0

Firewall guidance

If running Matrix Synapse: reverse proxy port 8008 through Nginx on 443 with TLS and rate limiting. Never expose Synapse 8008 directly. For Kubernetes services: use ClusterIP (not NodePort/LoadBalancer) for internal 8008 endpoints, enforce NetworkPolicy restricting source namespaces. General: treat 8008 identically to 8080 – never internet-facing without reverse proxy + TLS.

Diagnosis commands

Check if Matrix Synapse is running on 8008

shell
curl -s http://localhost:8008/_matrix/client/versions | jq .

Identify which process owns port 8008

shell
ss -tlnp sport = :8008

Generic health check for services on 8008

shell
curl -s http://localhost:8008/health -o /dev/null -w '%{http_code}'

Service detection – identify what is actually running on 8008

shell
nmap -sV -p 8008 target

Usage examples

Port 8008 – HTTP Alternate
shell
curl http://localhost:8008/healthz
kubectl port-forward svc/myapp 8008:8008
python3 -m http.server 8008

Common services on this port

Matrix SynapseKubernetes internal servicesHTTP-alt (IANA registered)Custom API serversIBM HTTP Server (secondary)

Related ports

80

HTTP standard

8080

HTTP alternate (more common)

8443

HTTPS alternate

443

HTTPS production

History

Port 8008 is IANA-registered as 'http-alt' (one of several HTTP alternates alongside 8080 and 591). Matrix Synapse adopted it as default in 2014 for the client-server API. In Kubernetes ecosystems, 8008 is commonly used for internal HTTP services that need a different port from the primary 8080. The port has no single dominant service – context determines what is running.

FAQ

What is typically running on port 8008?

Context-dependent. Most common: Matrix Synapse homeserver (federation/client API), Kubernetes internal microservices, secondary HTTP endpoints on multi-service hosts, and custom API servers. Run nmap -sV -p 8008 target or curl the port to identify the service by its response headers/body.