8000

Port 8000/tcp is registered with IANA under the service name irdmi, description "iRDMI," assignee and contact [Gil_Shafriri], with a blank reference field (dual-registered on both TCP and UDP as identical entries). The registry's row for 8000 carries no registration date, no modification date, no RFC or IANA reference, and no assignment notes — every one of those columns is blank in the source CSV, so they are recorded here as Unknown rather than guessed at. Third-party port databases gloss irdmi as "Intel Remote Desktop Management Interface," but that expansion appears in scrape-derived databases, not on the IANA page itself, and the specific Intel protocol is effectively unseen in real deployments — the formal registration is vestigial. What an analyst actually meets on 8000/tcp is almost never iRDMI: the port is one of the most common de-facto "HTTP-alt" ports, a default for local and development web servers (Python's http.server, Django's runserver, many Node.js apps), reverse proxies and API gateways, IoT and camera admin interfaces, and — per several port databases — SHOUTcast/Icecast internet-radio streaming. Several third-party databases also annotate 8000 as "sometimes erroneously used instead of port 8080," which is a database editorial note rather than IANA language and should be attributed to the database, not to IANA. Security-wise, because 8000 is non-standard it is frequently omitted from firewall scope, which leads to accidental internet exposure of dev/test servers: framework debug modes (Django/Flask) leaking stack traces, environment variables, or offering interactive debug consoles that permit code execution; unauthenticated IoT/camera admin panels; and open or misconfigured proxy services. Broad internet scanners such as Shodan routinely include 8000 in their HTTP-alt sweeps, and the nmap-services dataset ranks it 38th of 6,486 TCP entries at an observed open-frequency of ≈ 0.00971 — roughly 1 in 100 sampled hosts, which is high placement for a port with no real registered protocol behind it. No CVE or named-malware family was found specifically tied to port 8000 in this pass (unlike port 8080's documented associations), so that is left Unknown rather than borrowed from 8080.

IANA assignment

irdmi — "iRDMI"; reference (blank — no RFC cited in IANA registry); assignee/contact [Gil_Shafriri]; dual-registered 8000/tcp + 8000/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached copy, lines 11469–11470)

Range class

registered (1024–49151) [Confirmed] — IANA registry

Prevalence

nmap-services observed open-frequency 8000/tcp ≈ 0.00971 — low in absolute terms (~1 in 100 sampled hosts) but 38th of 6,486 TCP entries, the busiest band outside the standard service ports; the UDP sibling 8000/udp is ≈ 0.001652 [Likely] — nmap-services dataset. General scanners (Shodan) also include 8000 in their HTTP-alt sweeps

[Likely] — https://help.shodan.io/the-basics/on-demand-scanning

Registration/modification dates, service code, assignment notes

blank in registry CSV [Unknown] — IANA registry

Related ports

80 (HTTP), 8080 and 8888 (other HTTP-alt), 8443 (HTTPS-alt) [Likely]

Security implications

non-standard port often out of firewall scope → accidental exposure of dev/test servers; Django/Flask debug-mode leakage (stack traces, env vars, code execution via debug console); unauthenticated IoT/camera panels; open/misconfigured proxies [Likely] — https://www.pentestpad.com/port-exploit/port-8000-web-servers-development-apis ; https://scanitex.com/en/resources/ports/tcp/8000

Malware/CVE associations

none specific verified this pass (do not carry over 8080's associations) [Unknown]

`irdmi` meaning

commonly expanded as "Intel Remote Desktop Management Interface" by third-party databases; not spelled out by IANA; the specific Intel protocol is effectively unseen in practice [Likely] — https://whatportis.com/ports/8000_irdmi-intel-remote-desktop-management-interface-sometimes-erroneously-used-instead-of-port-8080

Primary (de-facto) use

generic HTTP-alt — default for dev/local web servers (Python http.server, Django runserver, Node.js), reverse proxies/API gateways, IoT/camera admin UIs, and SHOUTcast/Icecast streaming [Likely] — https://www.pentestpad.com/port-exploit/port-8000-web-servers-development-apis ; https://whatportis.com/ports/8000_commonly-used-for-internet-radio-streams-such-as-those-using-shoutcast

"Erroneously used instead of 8080" note

a third-party port-database editorial annotation, not IANA language [Likely] — https://whatportis.com/ports/8000_irdmi-intel-remote-desktop-management-interface-sometimes-erroneously-used-instead-of-port-8080

Analyst note

An open 8000/tcp is almost always an HTTP-alt web/dev server, proxy, IoT admin UI, or streaming server — not the registered iRDMI protocol. Probe the HTTP response; treat exposed dev-framework debug pages as high-risk.

Port 8000/udp is registered with IANA as irdmi, description "iRDMI," with assignee and contact both listed as [Gil_Shafriri], and blank reference, registration-date, and modification-date fields — dual-registered alongside 8000/tcp for the same name. The IANA entry is a name/description assignment only: there is no RFC, protocol specification, or published date behind it, and the blank Reference column is the normal state for this kind of row rather than a data gap. In practice, however, the "iRDMI" label describes almost nothing seen on the wire — real-world UDP/8000 traffic is dominated by media streaming, not by any protocol named iRDMI. VLC media player is commonly pointed at UDP/8000 to receive RTP or MPEG-TS streams; FFmpeg is routinely used to send and receive MPEG-TS over UDP/8000 in broadcast and IPTV workflows; GStreamer pipelines bind udpsrc/udpsink to UDP/8000 for RTP media transport; and professional video encoders/decoders (Teradek, Haivision, and similar) are frequently configured to emit or ingest MPEG-TS over the port. The far better-known face of 8000 lives on TCP, where it is an extremely common alternate HTTP development port and is associated with Dell OpenManage — but that is a distinct entry from this UDP registration. For an analyst, the useful framing is that UDP/8000 is a de-facto media-streaming port whose IANA name is essentially vestigial. Scanning-activity data from SANS ISC covers port 8000 without a TCP/UDP breakdown, so scan volumes attributed to "port 8000" cannot be treated as UDP-specific, and no source was found that isolates UDP/8000 exposure counts separately from TCP.

IANA assignment

irdmi — "iRDMI"; reference (blank — no RFC cited in IANA registry); assignee/contact [Gil_Shafriri]; dual-registered 8000/tcp + 8000/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, rows 11469 tcp / 11470 udp)

Range class

registered (1024–49151) [Confirmed] — 8000 falls in the IANA registered range

Registration/modification dates

blank in the source registry (no date published); reported blank as-is, not fabricated [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Related ports

8000/tcp (alternate HTTP dev port / Dell OpenManage); contrast RTP media ports and 8080 (HTTP alt)

Primary use (registered)

"iRDMI," a name-only IANA assignment with no published protocol specification; the label is not observed as a distinct protocol on the wire

De-facto use

media streaming over UDP/8000 — VLC (RTP / MPEG-TS receive), FFmpeg (MPEG-TS send/receive in broadcast & IPTV), GStreamer (udpsrc/udpsink RTP), and professional encoders/decoders (Teradek, Haivision)

Exposure/scanning

SANS ISC tracks port 8000 scanning (aggregated, not UDP-specific) at a Green (low) threat level; recorded top scanning sources include 185.177.72.29, 45.198.224.185, and 45.205.1.195; a historical 2004 annotation notes a scanning spike following HP Web JetAdmin vulnerability disclosure

Typically seen on

media-streaming endpoints, IPTV/broadcast encoders and decoders; an unexpected UDP/8000 flow is most likely a media stream

Related-context (TCP, not this entry)

8000/tcp is a very common alternate HTTP dev port and is associated with Dell OpenManage server administration [Likely] — SpeedGuide port 8000

UDP-specific caveat

no source isolates UDP/8000 scanning or exposure counts from TCP/8000; the SANS totals are port-wide, not UDP-only [Unknown] — no UDP-specific source found

Analyst note

UDP/8000's IANA name (iRDMI) is essentially vestigial — treat the port as a de-facto media-streaming channel, and do not read SANS "port 8000" scan volumes as UDP-specific.