Recently I started working with weblogic and see references to t3 in urls that appear in logs. What is this t3 protocol?
Weblogic's implementation of the RMI specification uses a proprietary protocol known as T3. You can think of T3 (and secure T3S) as a layer to expose/allow JNDI calls by clients.
T3 is the protocol used to transport information between WebLogic servers and other types of Java programs. WebLogic keeps track of every Java virtual machine connected to the application. To carry traffic to the Java virtual machine, WebLogic creates a single T3 connection. This type of connection maximizes efficiency by eliminating multiple protocols used to communicate between networks, thereby using fewer operating system resources. The protocol used for the T3 connection also enhances efficiency and minimizes packet sizes, increasing the speed of the delivery method.
Read more: https://docs.oracle.com/cd/E24329_01/web.1211/e24389/rmi_t3.htm#WLRMI143
You can check out some sample client creation code that uses T3 here: http://docs.oracle.com/cd/E11035_01/wls100/client/t3.html