Port reference
Port 548 (TCP) – AFP (Apple Filing Protocol)
Apple Filing Protocol for macOS network file sharing and Time Machine backups.
Default state
Open on macOS servers, older Macs, and NAS devices that enable AFP sharing.
Common attacks
- Authentication brute force against AFP user accounts
- Pre-auth server information disclosure via afp-serverinfo
- Exploitation of NAS/Netatalk vulnerabilities for RCE
- Unauthorized access to shared volumes and Time Machine backups
Hardening
- Prefer SMB (port 445) — AFP is deprecated by Apple
- Require strong authentication and disable guest access
- Never expose AFP to the internet; restrict to trusted LAN/VPN
- Patch Netatalk on NAS devices and keep macOS updated
nmap snippet
nmap -p548 --script afp-serverinfo,afp-brute <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 548?
Port 548 is the default for AFP, the Apple Filing Protocol, Apple's native network file-sharing protocol. It served macOS file shares and Time Machine backups for years and is implemented on many NAS devices via the open-source Netatalk. Apple has since deprecated AFP in favor of SMB, but it is still enabled on older Macs and storage appliances.
Why it matters for security
AFP discloses server information before authentication — machine name, supported auth methods, and shares — handing reconnaissance to anyone who can reach the port. Like any file-sharing service it is a target for credential brute force, and a foothold grants access to shared volumes and backups. Critically, Netatalk on NAS hardware has had serious remote-code-execution vulnerabilities, making exposed AFP a high-value target.
How it's attacked
Attackers first pull pre-auth server info to map shares and auth methods, then brute-force credentials to reach the volumes. Where vulnerable Netatalk builds are running on NAS devices, they chain known RCE exploits for full device compromise. Mass scanners find internet-exposed AFP quickly, and Time Machine backups make those shares especially valuable to steal or ransom.
Hardening checklist
Migrate to SMB (port 445) since AFP is deprecated. Require strong authentication, disable guest access, and never expose port 548 to the internet — keep it on a trusted LAN or behind a VPN. On NAS devices, patch Netatalk promptly and keep macOS updated. The nmap snippet above pulls server info and tests authentication on hosts you are authorized to test.
Related ports
Frequently asked questions
- Is AFP still used?
- AFP is deprecated; Apple now favors SMB for file sharing. It persists on older Macs, Time Machine setups, and NAS devices running Netatalk, where it remains a target.
- Why is exposed AFP dangerous?
- AFP leaks server details before authentication and is subject to credential brute force. Netatalk implementations on NAS devices have had serious remote-code-execution flaws, so internet exposure is high risk.