Port reference
Port 548 (TCP) – AFP (Apple Filing Protocol)
Apple Filing Protocol for macOS network file sharing and Time Machine backups.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on macOS servers, older Macs, and NAS devices that enable AFP sharing.
What is port 548 used for?
Port 548 (TCP) is the default for AFP, the Apple Filing Protocol, Apple's native network file-sharing protocol. For years it powered macOS file shares and Time Machine backups, and it is still offered by many NAS devices (Synology, QNAP, and others) through the open-source Netatalk server. Apple has since moved to SMB as the default, but AFP remains available on older Macs and storage appliances for compatibility with Mac clients.
When would you open it?
Open port 548 only if you run an AFP file server that Macs on your network need to reach, for example a NAS hosting shared folders or Time Machine backups for older devices. If your Macs already use SMB, you generally do not need AFP open at all.
Is it safe to open?
The main risk is exposing a login-protected, sometimes outdated service, so require strong passwords, disable guest access, and keep it on your LAN or behind a VPN rather than the internet. See the security notes below.
How to check if this port is open
ss -tulpn | grep :548
nmap -p 548 <target>netstat -ano | findstr :548
Test-NetConnection <host> -Port 548lsof -i :548
nmap -p 548 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 548 to your device's local IP, internal port 548, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 548/tcpsudo firewall-cmd --permanent --add-port=548/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 548 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 548" -Direction Inbound -Protocol TCP -LocalPort 548 -Action AllowSecurity & risks
Common attacks
- Authentication brute force against AFP user accounts
- Pre-auth server information disclosure via afp-serverinfo
- Exploitation of NAS/Netatalk vulnerabilities for RCE
- Unauthorized access to shared volumes and Time Machine backups
Hardening
- Prefer SMB (port 445) — AFP is deprecated by Apple
- Require strong authentication and disable guest access
- Never expose AFP to the internet; restrict to trusted LAN/VPN
- Patch Netatalk on NAS devices and keep macOS updated
How to block this port
sudo ufw deny 548/tcpsudo firewall-cmd --permanent --remove-port=548/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 548 -j DROPNew-NetFirewallRule -DisplayName "Block 548" -Direction Inbound -Protocol TCP -LocalPort 548 -Action Blocknmap snippet
nmap -p548 --script afp-serverinfo,afp-brute <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is AFP still used?
- AFP is deprecated; Apple now favors SMB for file sharing. It persists on older Macs, Time Machine setups, and NAS devices running Netatalk, where it remains a target.
- Why is exposed AFP dangerous?
- AFP leaks server details before authentication and is subject to credential brute force. Netatalk implementations on NAS devices have had serious remote-code-execution flaws, so internet exposure is high risk.