# WHATPORT(8180)

## NAME

port 8180 — Tomcat / HTTP alternate — Unassigned at IANA; a conventional second Tomcat port when 8080 is taken.

Protocol: TCP  
IANA: Unassigned

## DESCRIPTION

IANA lists the whole 8163–8180 block as Unassigned, so 8180 is unregistered. It is a common offset choice for a Java servlet container that cannot have 8080 — a second Tomcat instance, or one packaged to sit behind Apache httpd. It is also the port the widely used Metasploitable 2 training image leaves open, which is why 8180 turns up in so many teaching materials and scan write-ups.

## EXPOSURE

**Expose with care.** Application servers on alternate ports commonly still have the manager or admin webapp deployed; check /manager and /host-manager before exposing it.

## CHECK

```sh
curl -sI --max-time 5 http://TARGET:8180/
```

## SEE ALSO

- docs — [Rapid7 — Metasploitable 2 exploitability guide (8180/tcp open)](https://docs.rapid7.com/metasploit/metasploitable-2-exploitability-guide/) (docs.rapid7.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 8180](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8180) (iana.org)

---

HTML: <https://whatport.net/8180/> · JSON: <https://whatport.net/8180.json> · full dataset: <https://whatport.net/ports.json>