Why does Tomcat start listening on more ports?

luis carlos cruz castillo 0
Viewed 60

I'm aware that Tomcat uses ports 8080, 8009, and 8005. But recently I used netstat to see the ports Tomcat was using, and noticed that the PID of the Tomcat service was listening on multiple ports, it looked like this (the 2281 PID belongs to the Tomcat service)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp6       0      0 :::41020                :::*                    LISTEN      2281/java           
tcp6       0      0 :::34300                :::*                    LISTEN      2281/java           
tcp6       0      0 :::34621                :::*                    LISTEN      2281/java           
tcp6       0      0 :::37150                :::*                    LISTEN      2281/java           
tcp6       0      0 :::43231                :::*                    LISTEN      2281/java           
tcp6       0      0 :::34847                :::*                    LISTEN      2281/java           
tcp6       0      0 :::40512                :::*                    LISTEN      2281/java           
tcp6       0      0 :::35808                :::*                    LISTEN      2281/java           
tcp6       0      0 :::35168                :::*                    LISTEN      2281/java           
tcp6       0      0 :::33984                :::*                    LISTEN      2281/java           
tcp6       0      0 :::44577                :::*                    LISTEN      2281/java           
tcp6       0      0 :::34145                :::*                    LISTEN      2281/java           
tcp6       0      0 :::46786                :::*                    LISTEN      2281/java           
tcp6       0      0 :::44419                :::*                    LISTEN      2281/java           
tcp6       0      0 :::40291                :::*                    LISTEN      2281/java           
tcp6       0      0 :::41091                :::*                    LISTEN      2281/java           
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      2281/java           
tcp6       0      0 :::36903                :::*                    LISTEN      2281/java           
tcp6       0      0 :::39624                :::*                    LISTEN      2281/java           
tcp6       0      0 :::36072                :::*                    LISTEN      2281/java           
tcp6       0      0 :::38825                :::*                    LISTEN      2281/java           
tcp6       0      0 :::8009                 :::*                    LISTEN      2281/java
tomcat java
3 Answers

It is a fairly standard practice for a long lived process that listens on a single port (for example, 80) to spawn a child thread on a second port when a new, long lived connection is established.

For example,

  1. client sends message to server:80
  2. server spawns a child thread on a new port and directs the client to that new port.
  3. future messages between the client and server are via the new port.

My guess is that you have some number of keep alive connections to your Tomcat server.

DwB0

lsof utility + a thread dump could help to find which thread is opening the port

lsof -Pawn -iTCP -sTCP:LISTEN -K -F pfKMT0 -p 11630 +c 15 | tr '\000' ' ' | grep -v '^f'

Output sample

p11630 
p11630 K11636 Mjava 
p11630 K11646 MVM Thread 
p11630 K11647 MReference Handl 
p11630 K11648 MFinalizer  
p11630 K11692 Mhttp-nio-8080-e 
p11630 K11693 Mhttp-nio-8080-e 
p11630 K11694 Mhttp-nio-8080-e 
p11630 K11695 Mhttp-nio-8080-e 
p11630 K11696 Mhttp-nio-8080-e

Fields can be read as

 p11630            PID of tomcat (prefixed by 'p')  
 K11696            THREAD PID (prefix=K)  
 Mhttp-nio-8080-e  Thread name (prefix=M)

Alternative with awk

lsof -Pawn -iTCP -sTCP:LISTEN -K -p 11630 +c 15 | gawk '{print $1,$2,$3,$4,$11 }'      
COMMAND PID TID TASKCMD NAME
java 11630 11636 java *:8080
java 11630 11636 java 127.0.0.1:8009
java 11630 11636 java 127.0.0.1:8005
java 11630 11636 java *:37961
user4xTb0

Check Tomcat's configuration file server.xml for connectors (HTTP/1.1, HTTP/2, AJP).

Another thing is that applications (war files) deployed on Tomcat can also open ports if they so choose.

And the JVM could open yet another port when debugging or JMX gets activated. So you also want to check the concise command line used to run Tomcat.

Netstat will show the sum of those.

Hiran Chaudhuri0
Related