7000

Port 7000/tcp is registered with IANA under the service name afs3-fileserver with the description "file server itself," part of the Andrew File System (AFS/OpenAFS) port block; the assignee, contact, registration/modification dates, and reference fields are all blank in the registry, and 7000/udp carries an identical dual registration. That AFS3 fileserver role is now largely legacy — mostly seen in OpenAFS deployments — and it is not what an analyst usually finds behind an open 7000 today. Two well-documented modern uses dominate. First, Apple AirPlay: enabling the AirPlay Receiver on macOS, or running AirPlay v1 (RTSP-based) targets such as Apple TV, AirPort Express, HomePod, and various smart TVs/receivers, binds TCP 7000 automatically, with companion ports 7001 (video) and 7100 (display mirroring); this traffic is intended for LAN discovery/streaming, not the public internet. Second, Apache Cassandra: 7000/tcp is the default storage_port for unencrypted internode (node-to-node) communication — gossip, hints, streaming, and cluster topology. Before Cassandra 4.0 encrypted internode traffic used a separate ssl_storage_port (7001); as of 4.0 the single storage_port on 7000 can carry both. Cloud posture tools (Orca, Tenable, stream.security) explicitly flag unrestricted public inbound access to 7000 as a Cassandra misconfiguration, since internode traffic is unauthenticated by default and should be reachable only by cluster members. A historical, lower-confidence association also exists with the SubSeven/Sub7 Windows backdoor, but SubSeven's canonical default port is 27374 (NIPC Advisory 00-056); 7000 appears only as an attacker-configurable alternate in secondary port databases, so it should be described as "associated with," not the trojan's default. The IANA Reference field is blank and stays blank.

IANA assignment

afs3-fileserver — "file server itself"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 7000/tcp + 7000/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV + iana.org)

Range class

registered/user (1024–49151)

Registration/modification dates

none published by IANA for this assignment — Unknown (blank, not fabricated) [Unknown] — IANA registry

Related ports

7001 (AirPlay video / Cassandra ssl_storage_port), 7100 (AirPlay mirroring); 7000/udp (dual registration)

Primary use (registered)

AFS3 (Andrew File System) fileserver component — legacy/niche, mainly OpenAFS deployments

Security implications

public inbound 7000 flagged as a Cassandra internode misconfiguration (unauthenticated cluster traffic should be cluster-only); AirPlay use is LAN-only; legacy/low-confidence SubSeven association (canonical Sub7 port is 27374, 7000 only a secondary-database alternate)

Typically seen on

Cassandra cluster nodes; Macs/Apple TV/HomePod and AirPlay receivers on a LAN; legacy OpenAFS fileservers

Primary real-world use (1)

Apple AirPlay Receiver / AirPlay v1 (RTSP) — TCP 7000 bound automatically; companion ports 7001 (video), 7100 (mirroring); LAN-only by design [Confirmed] — Apple Developer Forums, openairplay spec, AirSquirrels networking docs

Primary real-world use (2)

Apache Cassandra default storage_port for unencrypted internode (gossip/hints/streaming); pre-4.0 encrypted internode used ssl_storage_port 7001, consolidated onto 7000 in 4.0 [Confirmed] — Cassandra project blog, DataStax secureFireWall docs

Analyst note

An open 7000 most likely means Cassandra internode or AirPlay, not AFS. Public-facing 7000 on a server is a Cassandra exposure worth flagging; on a LAN it is usually AirPlay.

Port 7000/udp is registered with IANA as afs3-fileserver with the description "file server itself" and a blank reference field; the same service name and description are registered identically for 7000/tcp, so this is a legitimate TCP/UDP dual registration rather than two unrelated allocations. In practice the port's canonical use is the AFS3 (Andrew File System) fileserver, the core data-serving component of a distributed filesystem: per OpenAFS's own service-port documentation, clients contact 7000/udp to locate volumes and read and write file data, and fileservers speak to one another over the same port. OpenAFS — the open-source AFS implementation — is the concrete software tied to this port today, and its deployment guidance explicitly tells administrators to keep 7000/udp open on file servers so that off-site or remote clients can reach them, which also makes misconfigured Internet exposure of an AFS fileserver a real, non-hypothetical concern rather than a purely theoretical one. Beyond AFS, generic port-directory aggregator sites list assorted informal uses (media streaming, remote-admin utilities, some games), but these carry no primary-source backing and are best treated as anecdotal "seen in the wild" rather than authoritative. A separate, strictly historical note applies to the TCP side: early-2000s "bad ports" and trojan-port reference lists associate TCP/7000 (not the UDP variant) with legacy backdoors such as SubSeven variants, Remote Grab, Kazimas, and Aladino; no source found ties those families to UDP/7000, and no dated, verified CVE specific to UDP/7000 or the AFS3 fileserver protocol on this port surfaced in this pass, so that stays a sourced null rather than a fabricated ID.

IANA assignment

afs3-fileserver — "file server itself"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; dual-registered 7000/tcp + 7000/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (and :10932 for tcp); IANA Service Name and Transport Protocol Port Number Registry

Range class

registered/user (1024–49151)

Related ports

the AFS3 service cluster (7001 afs3-callback, 7002 afs3-prserver, 7003 afs3-vlserver, 7004 afs3-kaserver, 7005 afs3-volser, 7007 afs3-bos)

Primary use

AFS3 (Andrew File System) fileserver RPC — clients locate volumes and read/write file data over 7000/udp; fileservers also communicate with each other on this port

Common software

OpenAFS (open-source AFS implementation); its docs instruct admins to keep 7000/udp open on file servers for remote clients

Other/unofficial uses

aggregator port-directory sites list media-streaming, remote-admin, and game uses of 7000; no primary-source backing

Security implications

an AFS fileserver with 7000/udp reachable from the open Internet exposes a distributed-filesystem RPC service (OpenAFS guidance covers firewall/NAT handling of this port precisely because it must be opened for remote clients)

Historical/legacy (TCP, not UDP)

early-2000s "bad ports"/trojan-port lists associate TCP/7000 with SubSeven variants, Remote Grab, Kazimas, Aladino; no source ties these to UDP/7000 [Threat-reported, dated/legacy] — https://www.garykessler.net/library/bad_ports.html

Known CVEs

Unknown — no specific dated CVE tied to UDP/7000 or the AFS3 fileserver protocol on this port found in this pass; recorded as sourced null, not fabricated [Unknown]

Analyst note

A responsive 7000/udp most plausibly indicates an AFS fileserver; confirm against the wider AFS3 7001–7009 cluster before concluding, and treat Internet-facing exposure as a misconfiguration worth flagging.