548

Port 548/tcp is registered with IANA as afpovertcp — the service name is literally afpovertcp, not afp — with the description "AFP over TCP," assignee and contact Leland Wallace (Apple), a blank reference field, and defined DNS-SD TXT keys (u=username, p=password, path=path); it is dual-registered on TCP and UDP. It carries Apple's native network file-sharing protocol: sharing volumes and folders to Macs, classic Mac file sharing, and historically Time Machine network backups, advertised over Bonjour as _afpovertcp._tcp. AFP is fork-aware — it handles resource and data forks and Mac metadata — and runs over TCP via the DSI (Data Stream Interface) layer; it replaced the older AFP-over-AppleTalk transport around Mac OS 9 / Mac OS X (1999–2001). Apple has since deprecated AFP in favor of SMB: SMB2 became the default file-sharing protocol in OS X 10.9 Mavericks (2013), and Apple's macOS 15.5 enterprise release notes (build 24F74, released 12 May 2025) state that the AFP client is deprecated and will be removed in a future version of macOS, with macOS 27 (expected fall 2026) reported to drop AFP-based Time Machine and AirPort Time Capsule backups entirely. The IANA reference field is blank. Security-wise the defining issue is netatalk, the open-source AFP server used by most NAS vendors: CVE-2018-1160 is an out-of-bounds write in the DSI OpenSession handler that allows unauthenticated remote code execution as root (CVSSv3 9.8 / CVSSv2 10.0), discovered by Jacob Baines (Tenable advisory TRA-2018-48; Debian DSA-4356), published 2018-12-20 and fixed in netatalk 3.1.12 / 2.2.7, affecting NAS devices from Seagate, Synology, Western Digital, and QNAP; a further 2022 cluster fixed in netatalk 3.1.13 (released 2022-03-22) addressed CVE-2021-31439 and CVE-2022-23121/23122/23123/23124/23125 and CVE-2022-0194 — several unauthenticated RCEs up to CVSS 9.8, with CVE-2022-23121 demonstrated at Pwn2Own against a Western Digital PR4100 — prompting Synology and QNAP advisories and Western Digital's removal of netatalk from its firmware. For an analyst, an open 548 indicates a Mac sharing files or, far more often on the public internet, a NAS running netatalk; check the netatalk version against CVE-2018-1160 and the 2022 cluster, and prefer SMB.

IANA assignment

afpovertcp (NOT afp) — "AFP over TCP"; reference (blank — no RFC cited in IANA registry); assignee Leland Wallace (Apple); DNS-SD TXT keys u/p/path; dual-registered 548/tcp + 548/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency ~0.012395 (de-facto; highest in this batch) [Well-established] — nmap-services file

Related ports

427 (SLP, AFP discovery), 5353 (mDNS/Bonjour), 139/445 (SMB, the replacement), 311 (AppleShare IP WebAdmin)

Primary use

Apple Filing Protocol over TCP — Mac network file sharing (volumes, fork-aware files), Bonjour-advertised

Other/unofficial uses

historically AppleShare / AppleShare IP; Time Machine network backups [Well-established]

Security implications

AFP deprecated by Apple (SMB2 default since 10.9, 2013; AFP client deprecated per macOS 15.5 notes, removal in a future macOS); netatalk CVE-2018-1160 (unauth RCE as root, CVSS 9.8, fixed 3.1.12/2.2.7, Jacob Baines/Tenable, 2018-12-20) + 2022 cluster (CVE-2022-23121 etc., fixed 3.1.13) affecting Synology/QNAP/WD NAS

Typically seen on

Macs sharing files; NAS running netatalk (Synology/QNAP/WD/Seagate); Time Capsule

Analyst note

An open 548 indicates a Mac sharing files or (more often on the public internet) a NAS running netatalk; check the netatalk version against CVE-2018-1160 and the 2022 cluster, and prefer SMB.

Port 548/udp carries the IANA-registered service afpovertcp (Apple Filing Protocol), and it should stay internal-only rather than exposed to the public internet, since the documented AFP file-sharing traffic for this service pair runs almost entirely over TCP/548 rather than UDP/548.

IANA registers afpovertcp jointly on 548/tcp and 548/udp, assignee [Leland_Wallace], with the Reference field left blank (no RFC is cited for this assignment). The registry's assignment notes list defined TXT keys u=<username>, p=<password>, and path=<path>, historically used in AFP service-discovery TXT records rather than the file-transfer protocol itself.

AFP is Apple's legacy network file-sharing protocol, used by classic Mac OS and macOS/OS X File Sharing, older OS X Server installs, and — in older deployments — Time Machine network backups and AirPort Time Capsule devices. No source reviewed documents a distinct UDP-specific session behavior for port 548; the UDP row appears to exist mainly because the service name is dual-registered, not because UDP carries independent AFP traffic.

In the nmap-services corpus, 548/udp measures an open-frequency of 0.000774 (~0.077%), well below 548/tcp's 0.012395 (~1.24%) in the same dataset — consistent with UDP/548 being a rarely-open, largely vestigial counterpart to the active TCP service.

Exposure

Internal-only — AFP file-sharing exposes filesystem contents and should never face the public internet on either transport.

Protocol note

IANA pairs afpovertcp on 548/tcp and 548/udp, but documented AFP sessions run almost entirely over TCP; no distinct UDP protocol behavior is documented.

Scanning

No dated scanning or honeypot statistics specific to 548/udp turned up as of an August 2026 search; UDP scanning is generally a small minority of overall internet port-scan traffic.

Legacy status

Apple has moved default macOS file sharing to SMB, leaving AFP — and by extension 548/udp — a legacy protocol footprint mainly seen on older hosts.

IANA assignment

afpovertcp — "AFP over TCP" (IANA description; nmap-services labels the UDP row "AFP over UDP"); Reference blank; assignee [Leland_Wallace]; dual-registered 548/tcp + 548/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed] — this site's own tooling

Prevalence

nmap-services open-frequency 548/udp = 0.000774 (~0.077%); 548/tcp = 0.012395 (~1.24%) in the same corpus [Confirmed] — this site's own tooling

Related ports

548/tcp (active AFP-over-TCP counterpart); 445/tcp (SMB, AFP's modern replacement); 139/tcp (NetBIOS session service) [Likely]

Primary use

Apple Filing Protocol (AFP) network file sharing; IANA registers the name on both transports, but real AFP sessions run almost entirely over TCP

Other/unofficial uses

macOS/OS X built-in File Sharing (AFP option); legacy OS X Server; older Time Machine network backups over AFP; AirPort Time Capsule (legacy)

Security implications

AFP predates modern authentication/encryption norms and has been superseded by SMB on current macOS; AFP services should stay off the public internet regardless of transport; no CVE or malware association recorded for 548/udp as of an August 2026 search

Typically seen on

legacy macOS/OS X hosts and older Apple NAS-adjacent devices running AFP file sharing; the TCP side carries actual sessions, so a lone UDP/548 responder is atypical [Likely]

Analyst note

A responsive 548/udp is uncommon relative to 548/tcp — treat it as worth confirming rather than assuming standard AFP file-sharing behavior, since documented AFP traffic is overwhelmingly TCP-based.