What is TCP port 8080 commonly used for, and why might a security team choose to block it on the perimeter?

• A.TCP 8080 is the default port for RDP on non-Windows servers
• B.TCP 8080 is a commonly used alternative HTTP port (HTTP alternate, HTTP proxy port); commonly used by: development web servers (Python HTTPServer, Node.js Express default), application servers (Tomcat, JBoss), web proxies (Squid, HTTP proxies). Security teams may block 8080 because: (1) some malware and C2 frameworks use 8080 to evade simple port-based firewalls that only allow 80/443; (2) unintentional internal web service exposure -- developers spin up test servers on 8080 and forget them; (3) policy: allow only standard web ports (80/443) through the perimeter
• C.TCP 8080 is an encrypted variant of HTTP that provides TLS without certificate requirements, because IMAP stores mail only on the client, deleting the server copy at download. SNMP agents receive polls on UDP 514, the same port syslog collectors listen on. IPsec ESP uses TCP port 50 and AH uses TCP port 51 for tunnel setup. DHCP servers listen on UDP 68 and clients answer from UDP 67. MySQL and Microsoft SQL Server share TCP 1433 by alternating even and odd connection IDs on enterprise equipment