# WHATPORT(2809)

## NAME

port 2809 — CORBA corbaloc / IIOP bootstrap — A CORBA bootstrap agent — in practice, usually an IBM WebSphere Application Server.

Protocol: TCP  
IANA: corbaloc

## DESCRIPTION

2809 is the default port for a corbaloc: URL, the CORBA Interoperable Naming Service address a client uses to resolve an initial object reference over IIOP without a full naming lookup. Java EE servers built on IIOP inherit it: WebSphere's default JNDI provider URL is literally corbaloc:iiop:localhost:2809, and the port is the WebSphere bootstrap/RMI-IIOP endpoint. On a scan it says "Java application server", and the naming service on it will happily enumerate bound objects to an unauthenticated client.

## EXPOSURE

**Do not expose.** The bootstrap and naming service usually answer without authentication and it is a Java deserialization path into the application server — keep it behind the perimeter.

## CHECK

```sh
nmap -Pn -p 2809 --script giop-info TARGET
```

## SEE ALSO

- docs — [omniORB manual — Interoperable Naming Service (corbaloc, default port 2809)](https://omniorb.sourceforge.io/omni43/omniORB/omniORB008.html) (omniorb.sourceforge.io)
- docs — [IBM Documentation — Getting the default initial context (corbaloc:iiop:localhost:2809)](https://ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.base.doc/ae/rnam_example_prop1.html) (ibm.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 2809 (corbaloc)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2809) (iana.org)

---

HTML: <https://whatport.net/2809/> · JSON: <https://whatport.net/2809.json> · full dataset: <https://whatport.net/ports.json>