548

Port 548/tcp is registered with IANA as afpovertcp — the service name is literally afpovertcp, not afp — with the description "AFP over TCP," assignee and contact Leland Wallace (Apple), a blank reference field, and defined DNS-SD TXT keys (u=username, p=password, path=path); it is dual-registered on TCP and UDP. It carries Apple's native network file-sharing protocol: sharing volumes and folders to Macs, classic Mac file sharing, and historically Time Machine network backups, advertised over Bonjour as _afpovertcp._tcp. AFP is fork-aware — it handles resource and data forks and Mac metadata — and runs over TCP via the DSI (Data Stream Interface) layer; it replaced the older AFP-over-AppleTalk transport around Mac OS 9 / Mac OS X (1999–2001). Apple has since deprecated AFP in favor of SMB: SMB2 became the default file-sharing protocol in OS X 10.9 Mavericks (2013), and Apple's macOS 15.5 enterprise release notes (build 24F74, released 12 May 2025) state that the AFP client is deprecated and will be removed in a future version of macOS, with macOS 27 (expected fall 2026) reported to drop AFP-based Time Machine and AirPort Time Capsule backups entirely. The IANA reference field is blank. Security-wise the defining issue is netatalk, the open-source AFP server used by most NAS vendors: CVE-2018-1160 is an out-of-bounds write in the DSI OpenSession handler that allows unauthenticated remote code execution as root (CVSSv3 9.8 / CVSSv2 10.0), discovered by Jacob Baines (Tenable advisory TRA-2018-48; Debian DSA-4356), published 2018-12-20 and fixed in netatalk 3.1.12 / 2.2.7, affecting NAS devices from Seagate, Synology, Western Digital, and QNAP; a further 2022 cluster fixed in netatalk 3.1.13 (released 2022-03-22) addressed CVE-2021-31439 and CVE-2022-23121/23122/23123/23124/23125 and CVE-2022-0194 — several unauthenticated RCEs up to CVSS 9.8, with CVE-2022-23121 demonstrated at Pwn2Own against a Western Digital PR4100 — prompting Synology and QNAP advisories and Western Digital's removal of netatalk from its firmware. For an analyst, an open 548 indicates a Mac sharing files or, far more often on the public internet, a NAS running netatalk; check the netatalk version against CVE-2018-1160 and the 2022 cluster, and prefer SMB.

IANA assignment

afpovertcp (NOT afp) — "AFP over TCP"; reference (blank — no RFC cited in IANA registry); assignee Leland Wallace (Apple); DNS-SD TXT keys u/p/path; dual-registered 548/tcp + 548/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.012395 (de-facto; highest in this batch) [Well-established] — nmap-services file

Related ports

427 (SLP, AFP discovery), 5353 (mDNS/Bonjour), 139/445 (SMB, the replacement), 311 (AppleShare IP WebAdmin)

Primary use

Apple Filing Protocol over TCP — Mac network file sharing (volumes, fork-aware files), Bonjour-advertised

Other/unofficial uses

historically AppleShare / AppleShare IP; Time Machine network backups [Well-established]

Security implications

AFP deprecated by Apple (SMB2 default since 10.9, 2013; AFP client deprecated per macOS 15.5 notes, removal in a future macOS); netatalk CVE-2018-1160 (unauth RCE as root, CVSS 9.8, fixed 3.1.12/2.2.7, Jacob Baines/Tenable, 2018-12-20) + 2022 cluster (CVE-2022-23121 etc., fixed 3.1.13) affecting Synology/QNAP/WD NAS

Typically seen on

Macs sharing files; NAS running netatalk (Synology/QNAP/WD/Seagate); Time Capsule

Analyst note

An open 548 indicates a Mac sharing files or (more often on the public internet) a NAS running netatalk; check the netatalk version against CVE-2018-1160 and the 2022 cluster, and prefer SMB.