What is port 8009 for?

It's the AJP (Apache JServ Protocol) connector in Apache Tomcat, used for communication between Tomcat and a front-facing web server like Apache HTTP Server or nginx. It's separate from Tomcat's own HTTP connector, which typically runs on 8080.

Is it safe to kill a process on port 8009?

Yes, if it's a local Tomcat instance you're running for development. Stopping Tomcat (rather than just killing the port) is the cleaner way to do it.

Is port 8009 a security risk?

It can be. AJP was the vector for CVE-2020-1938, nicknamed Ghostcat, which let attackers read arbitrary files from a Tomcat server if AJP was exposed. The connector should never be reachable from the public internet; it's meant for internal communication only.

Port 8009: Tomcat's AJP Connector (and the Ghostcat Vulnerability)

Port 8009 shows up alongside 8080 on any machine running Apache Tomcat, but it does a different job: it’s the AJP connector, not the HTTP one.

What typically listens on port 8009

Apache Tomcat (AJP connector): Tomcat exposes AJP on 8009 for binary-protocol communication with a reverse proxy like Apache HTTP Server (mod_jk/mod_proxy_ajp) or nginx, as an alternative to plain HTTP.
Jenkins and other Java tools that embed Tomcat: Some tools bundling Tomcat also expose this connector even if you never intentionally configured AJP.

Is it safe to kill?

For local development, yes. Stopping the Tomcat process (or just this connector, if you only need HTTP) is safe and won’t affect anything outside that Tomcat instance.

Is it suspicious?

This is one of the few ports on this list worth actively checking for exposure, not just presence. AJP was the mechanism behind Ghostcat (CVE-2020-1938), a 2020 vulnerability that let an attacker read files (including web app source and configuration) from a Tomcat server with AJP reachable. The fix, if you’re running Tomcat, is making sure port 8009 is never exposed to the public internet and that you’re on a patched Tomcat version. On your own local dev machine behind a router, it’s not an active risk; the concern is specifically about internet-facing servers.

How to check port 8009 on macOS

lsof -i :8009

If you’re running a local Tomcat for development:

kill -9 $(lsof -ti :8009)

Portie makes it easy to confirm exactly what’s bound to 8009 on your machine, useful both for local dev cleanup and for double-checking a server’s exposed ports before deploying it anywhere public.