8088

Port 8088/tcp is registered with IANA under the service name radan-http ("Radan HTTP"), assignee and contact "[Steve_Hay]," registration date 2008-06-13, with a blank Reference field; the same name and date are dual-registered on 8088/udp. That registry entry, however, tells you almost nothing about what actually answers on 8088 in the wild. In practice the port is best known for three specific, well-documented services, none of them the registered one. First, Apache Hadoop's YARN ResourceManager web UI and REST API default to <hostname>:8088 (yarn.resourcemanager.webapp.address), which is why 8088 shows up across Hadoop/Cloudera/HDP clusters and managed offerings like Amazon EMR and Azure HDInsight. Second, Splunk Enterprise and Splunk Cloud's HTTP Event Collector (HEC) listens on 8088 by default (typically over HTTPS) for event ingestion. Third, Confluent's ksqlDB REST API defaults to 8088. Beyond those, 8088 is a common generic "alternate HTTP" choice for proxies, web UIs, and admin interfaces when 80/8080 are taken. For an analyst, the dominant security concern is the Hadoop YARN ResourceManager REST API: YARN defaults to simple (unauthenticated) security mode, and its REST API on 8088 lets an unauthenticated caller create an application and submit a command the ResourceManager will execute — a documented unauthenticated remote-command-execution path (Metasploit exploit/linux/http/hadoop_unauth_exec, ExploitDB #45025) that has been exploited in the wild by cryptomining botnets, notably Kinsing, against internet-exposed clusters. The commonly cited mitigation is enabling Kerberos (hadoop.security.authentication=kerberos) and not exposing the ResourceManager to the public internet. SANS ISC's port tracker shows ongoing internet-wide scanning of 8088 (threat level rated "Green" at check time), though those figures are a live day-to-day snapshot rather than a durable statistic. A responsive 8088 therefore warrants identifying which of these services is actually behind it before assuming the benign IANA name.

IANA assignment

radan-http — "Radan HTTP"; reference (blank — no RFC cited in IANA registry); assignee/contact [Steve_Hay]; registration date 2008-06-13; dual-registered 8088/tcp + 8088/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached copy, lines 11586–11587)

Range class

registered (1024–49151)

Prevalence

nmap-services observed open-frequency 8088/tcp ≈ 0.000608 — very low (roughly 6 in 10,000 scanned hosts in the nmap-services sample); the paired 8088/udp row carries a frequency of 0 (never observed open in the same sample), consistent with every known service on this port speaking HTTP(S) over TCP [Confirmed for the figures; Likely for the reading] — nmap-services dataset. Note the nmap-services figure is an open-frequency ratio from a fixed historical scan sample, not a live host count: no dated, durable internet-wide exposure count was verified this pass, and Shodan-style host counts are query-time and were not queried here [Unknown]

Related ports

8080 (alternate HTTP), 8443 (alternate HTTPS), 9000/50070 (other Hadoop web endpoints)

Primary use (de-facto)

Apache Hadoop YARN ResourceManager web UI/REST API default; Splunk HTTP Event Collector (HEC) default; Confluent ksqlDB REST API default — the registered radan-http name does not reflect actual dominant use

Other/unofficial uses

generic alternate-HTTP port for proxies, web UIs, and admin interfaces when 80/8080 are in use

Security implications

unauthenticated Hadoop YARN ResourceManager REST API on 8088 permits remote command execution (default simple security mode); public Metasploit module exploit/linux/http/hadoop_unauth_exec and ExploitDB #45025; exploited in the wild by cryptomining botnets (Kinsing); mitigate via Kerberos and by not exposing to the internet

Typically seen on

Hadoop/YARN clusters (incl. EMR, HDInsight), Splunk HEC endpoints, ksqlDB deployments, and generic alternate-HTTP servers

Scanning activity

SANS ISC port/8088 tracker shows ongoing internet-wide scanning; threat level "Green" (lowest) at check time (2026-07-02); underlying source-IP/count figures are a live snapshot, not a stable statistic [Likely] — SANS ISC

Analyst note

the IANA radan-http registration is real but does not indicate the port's actual dominant use; fingerprint the responding service (YARN UI vs. Splunk HEC vs. ksqlDB vs. generic proxy) before drawing conclusions.

Port 8088/udp is registered with IANA as radan-http with the description "Radan HTTP," assignee/contact [Steve_Hay], and a registration date of 2008-06-13. The reference field is blank in the registry — no RFC is cited for this assignment. The port is dual-registered: the identical service name, description, assignee, and 2008-06-13 date appear on both the 8088/tcp and 8088/udp rows of the IANA Service Name and Transport Protocol Port Number Registry, so the UDP entry is the mirror of its TCP sibling rather than a separate service. It sits in the registered range (1024–49151). Everything that makes port 8088 well known in practice — the Apache Hadoop YARN ResourceManager web UI and REST API, the Splunk HTTP Event Collector, and Confluent's ksqlDB REST API — is TCP/HTTP(S)-based; none of those services bind to UDP, so their popularity should not be projected onto the UDP variant. No verified real-world service that actually speaks UDP on 8088 was found in this pass: observed UDP-8088 traffic in the wild is most plausibly scanning or probing noise rather than a documented protocol, and no UDP-specific exposure statistic, amplification/reflection abuse report, or malware association surfaced. The documented 8088 security concern — the unauthenticated YARN ResourceManager REST API remote-command-execution abused by cryptomining botnets such as Kinsing — is a TCP/HTTP issue and does not apply to UDP. For an analyst, a responsive 8088/udp therefore carries no established standard meaning; it is worth investigating as probe traffic or a custom/proprietary UDP application rather than assumed to be radan-http or a YARN endpoint. The authoritative TCP-side research lives in the sibling entry and should not be duplicated here as if verified for UDP.

IANA assignment

radan-http — "Radan HTTP"; reference (blank — no RFC cited in IANA registry); assignee/contact [Steve_Hay]; registration date 2008-06-13; dual-registered 8088/tcp + 8088/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 11587, paired tcp row line 11586)

Range class

registered (1024–49151) [Confirmed] — IANA registry

Modification date

(blank in registry — not recorded) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 11587

Prevalence / exposure (UDP-specific)

Unknown — no dated, durable UDP-8088 exposure count, Shodan-style statistic, or amplification-abuse report found; the SANS ISC/DShield port 8088 activity page returned HTTP 403 on fetch and reflects mainly TCP-side scanning [Unknown] — https://www.dshield.org/data/port/8088

Primary use (UDP-specific)

Unknown — no verified evidence of a distinct real-world service using 8088/udp; the port's de-facto fame (Hadoop YARN ResourceManager, Splunk HEC, Confluent ksqlDB) is entirely TCP/HTTP(S) and does not run over UDP [Unknown] — https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/ResourceManagerRest.html, https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector

Common software

none verified for the UDP variant; the well-documented software (YARN, Splunk HEC, ksqlDB) is TCP-only and would be incorrect to attribute to 8088/udp [Likely]

Security implications (UDP-specific)

Unknown — the documented 8088 concern (unauthenticated Hadoop YARN ResourceManager REST API RCE, exploited by Kinsing and similar cryptominers) is TCP/HTTP; no UDP-specific vulnerability, amplification vector, or malware association found [Unknown]

Related entry

8088/tcp holds the researched TCP-side content (radan-http registration + YARN/Splunk HEC/ksqlDB de-facto use + YARN RCE risk); do not duplicate it here as UDP-verified [Confirmed]

Analyst note

a responsive 8088/udp has no established standard meaning — treat as probe/scan noise or a custom UDP application and investigate; do not assume radan-http or a YARN endpoint.