8008
Summary
- // if you see it open
- Port 8008 is a common Shodan/Censys fingerprint for exposed Google Cast/Chromecast and Google Home devices (often open alongside 8009). Documented Chromecast/Google Home 'hijacking' incidents (devices commandeered to play unwanted content) relied on enumerating devices with these ports open, sometimes via Shodan-derived IP lists (Sophos, Pen Test Partners, 2019). Scanner-based identification is imperfect — it cannot reliably distinguish genuine devices from honeypots emulating the fingerprint, so exposure/scan statistics are approximate. As a general-purpose HTTP-alt port, an 8008 listener on the open internet also carries the generic risk of exposing an unauthenticated or under-hardened web/admin interface not intended for public reach.
- // analyst note
- an open 8008 is most often a Chromecast/Google Home device or an ad-hoc alternate/admin web server; treat exposure statistics as approximate and inspect the actual HTTP banner rather than assuming the service from the port alone.
About port 8008/tcp.
Port 8008/tcp is registered with IANA as http-alt with the description "HTTP Alternate," assignee James Gettys (both the Assignee and Contact fields), and a blank reference field; the registration is dual — identical rows exist for both 8008/tcp and 8008/udp with no fields differing between the two transport entries. There is no RFC governing this specific port assignment: the IANA entry is a registered alternate-HTTP service name (a duplicate of the http service, not intended for service discovery), so the reference/RFC column is legitimately blank rather than missing. In practice port 8008 is an alternate HTTP port, chosen when port 80 is unavailable or to separate a secondary or administrative web service from the primary one on the same host. Several concrete deployments recur: Google Cast / Chromecast and Google Home devices expose TCP 8008 as part of their local discovery and control HTTP interface (typically alongside 8009 and related ports); IBM HTTP Server has historically used 8008 as a default administrative access port; and Apple's CalendarServer (the CalDAV/CardDAV service in macOS Server's Calendar/Contacts) has used TCP 8008 as a default HTTP port. Beyond those named products it is a common ad-hoc pick for development servers, proxies, and internal or microservice web interfaces because it is an easy-to-remember IANA-registered alternate. For an analyst the notable exposure signal is Google Cast: internet-wide scanners (Shodan, Censys) fingerprint reachable Chromecast/Google Home devices by the open-8008 signature, and documented "hijacking" incidents (devices commandeered to play unwanted content) relied on enumerating such devices — though scanner-based identification cannot reliably distinguish genuine devices from honeypots emulating that fingerprint, so exposure counts for this port should be treated as approximate. As a general-purpose HTTP-alt port, an 8008 listener on the open internet also carries the ordinary risk of exposing an unauthenticated or under-hardened web/admin interface not meant for public reach.
- IANA assignment
http-alt— "HTTP Alternate"; reference (blank — no RFC cited in IANA registry); assignee James Gettys; dual-registered 8008/tcp + 8008/udp with identical row data [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cache the IANA Service Name and Transport Protocol Port Number Registry rows 11485/11486; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=http-alt)- Range class
- registered (1024–49151)
- Related ports
- 8009 (Chromecast companion), 80/8080 (HTTP alternates), 8443 (HTTPS-alt)
Primary use
alternate HTTP port, used when port 80 is unavailable or to separate a secondary/administrative web service from the primary one on the same host; IANA name http-alt is a duplicate of http, not for service discovery
Other/unofficial uses
Google Cast / Chromecast + Google Home local control/discovery HTTP interface (with 8009); IBM HTTP Server default admin access port; Apple CalendarServer (CalDAV/CardDAV) default HTTP port; ad-hoc dev servers, proxies, microservice web UIs
Security implications
8008 is a Shodan/Censys fingerprint for exposed Google Cast/Chromecast devices; documented Chromecast/Google Home hijacking used scanner-derived device lists (Sophos, Pen Test Partners, 2019); scanner identification is imperfect (cannot separate real devices from emulating honeypots), so exposure figures are approximate; as a generic HTTP-alt port it also risks exposing unauthenticated/under-hardened web-admin interfaces
Typically seen on
Google Cast/Chromecast + Google Home devices; hosts running an alternate or admin HTTP service; development/proxy/internal web servers
- Analyst note
- an open 8008 is most often a Chromecast/Google Home device or an ad-hoc alternate/admin web server; treat exposure statistics as approximate and inspect the actual HTTP banner rather than assuming the service from the port alone.
About port 8008/udp.
Port 8008/udp is registered with IANA as http-alt with the description "HTTP Alternate," assignee James Gettys, and a blank reference field. The registration is dual — 8008 carries an identical http-alt / "HTTP Alternate" / [James_Gettys] entry on both TCP and UDP, and every row leaves Reference, Registration Date, and Modification Date blank. The important caveat for an analyst is that this UDP registration is largely nominal: 8008 is a well-known de-facto alternate-HTTP port whose real-world traffic is overwhelmingly TCP. HTTP itself runs over TCP, so the "HTTP Alternate" label describes what people actually do on 8008/tcp — run web servers, proxies (Squid is a common example), development or admin HTTP endpoints, Fortigate firewall block pages, Novell/NetIQ eDirectory iMonitor, and Google Cast (Chromecast/Google Home) discovery and control alongside 8009. No source documents a distinct UDP protocol behavior for 8008 beyond the shared IANA label; because UDP is connectionless, any genuine service here would have to be defined per-application, and none of the sources found do so. SANS ISC's Internet Storm Center tracks combined tcp/udp scan activity on 8008 and shows ongoing low-level background internet scanning (green threat level as of the check date; daily top-scanner counts are a moving snapshot, not a stable fact). User comments on that page report legitimate encounters with 8008 including Fortigate block pages, OWASP WebScarab proxy tooling, and eDirectory iMonitor. For an analyst, a UDP hit on 8008 is best treated as anomalous or scanner-driven rather than evidence of a defined UDP service, while the far more meaningful signal is the TCP side, where alternate-HTTP and Cast-device traffic dominate.
- IANA assignment
http-alt— "HTTP Alternate"; reference (blank — no RFC cited in IANA registry); assignee James Gettys ([James_Gettys]); dual-registered 8008/tcp + 8008/udp with identical service name, description, and assignee [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local snapshot the IANA Service Name and Transport Protocol Port Number Registry, udp row)- Range class
- registered/user (1024–49151)
- Related ports
- 8009 (Cast companion), 8080 (http-proxy / common alternate HTTP), 80/443 (standard HTTP/S)
Primary use
de-facto alternate HTTP; real traffic is overwhelmingly TCP-based (web servers, proxies such as Squid, dev/admin HTTP endpoints) [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8008 , https://www.speedguide.net/port.php?port=8008
Other/unofficial uses
Google Cast — Chromecast/Google Home device discovery and control (alongside 8009); Fortigate firewall block pages; Novell/NetIQ eDirectory iMonitor; OWASP WebScarab proxy
Security implications
SANS ISC tracks combined tcp/udp scan activity on 8008 at a low/green threat level; user reports note eDirectory iMonitor has had documented past vulnerabilities; specific daily scan counts are a moving snapshot, not a stable fact
Typically seen on
alternate-HTTP web/proxy servers and Cast-capable devices (TCP); a UDP hit is anomalous / likely scanner-driven
- UDP-specific behavior
- Unknown — no source describes a distinct UDP protocol for 8008 apart from the shared http-alt label; UDP is connectionless and no per-application definition was found [Unknown]
- Analyst note
- the meaningful 8008 signal is on TCP; treat a UDP observation as anomalous or scan noise absent an application that explicitly defines UDP behavior.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| http | TCP | IBM HTTP server | 0.68% |
| http-alt | UDP | HTTP Alternate | 0.03% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.