Port 548 – AFP

TCP

Port 548 is the AFP (Apple Filing Protocol) port for macOS file sharing. AFP handles resource forks, Finder metadata, and Spotlight indexing that SMB cannot fully represent. Apple deprecated AFP in favor of SMB3 starting with macOS 10.9 – new deployments should use SMB on port 445.

Port Number

548

Protocol

TCP

Service

Apple Filing Protocol

Range

IANA Well-Known (0–1023)

Description

Apple Filing Protocol on port 548 was the native macOS file sharing protocol for decades. It supports Mac-specific features like resource forks, type/creator codes, and Spotlight search indexing that other protocols cannot preserve. Time Machine backups originally required AFP. Apple deprecated AFP in macOS Ventura and recommends SMB3 for all new file sharing. SMB3 on macOS now handles most AFP-specific metadata through extended attributes. AFP remains necessary only for connecting to legacy macOS/OS X servers or Netatalk on Linux. Port 548 should not be exposed beyond the local network.

Security risks

1CVE-2022-23121: Netatalk AFP RCE – unauthenticated remote code execution via crafted AFP packets (CVSS 9.8, affects NAS devices running Netatalk – Synology, QNAP, WD)
2CVE-2022-23125: Netatalk heap overflow in AFP login – allows unauthenticated RCE by sending crafted authentication requests to port 548
3Deprecated by Apple: AFP receives no new security development from Apple since macOS Ventura (2022) deprecated AFP sharing. Any future vulnerabilities will not be patched
4Cleartext password authentication: AFP's legacy auth modes (DHX, DHCAST128) have known weaknesses. Only Kerberos auth over AFP provides adequate security
5Resource fork exploitation: AFP's dual-fork file model (data fork + resource fork) creates unique attack vectors not present in SMB – malicious resource forks can carry payloads

Firewall guidance

Disable AFP and use SMB3 instead. macOS: System Settings → General → Sharing → disable 'Share files and folders using AFP'. On NAS devices: disable AFP protocol in settings. For Time Machine: macOS 12+ uses SMB by default. If AFP must remain for legacy clients: restrict to the local subnet and ensure Kerberos auth is required.

Diagnosis commands

macOS: list shares and check if AFP is enabled

shell

sharing -l | grep -i afp

Enumerate AFP shares on target (should fail if disabled)

shell

nmap -p 548 --script afp-showmount target

Check if AFP file server is listening

shell

lsof -i :548

macOS: read AFP server configuration

shell

defaults read /Library/Preferences/com.apple.AppleFileServer

Usage examples

Port 548 – AFP

shell

mount_afp afp://user@server/share /mnt
dscl . -read /Config/AFP
sharing -l

Common services on this port

macOS File Sharing (legacy)Netatalk (Linux/NAS AFP server)Synology DSM (AFP option)Time Machine (pre-Big Sur)

Related ports

445

SMB3 (Apple's recommended replacement)

548

AFP (this port)

427

SLP (AFP service discovery on older macOS)

5353

mDNS (AFP service discovery via Bonjour)

History

AFP (Apple Filing Protocol) was created by Apple in 1986 for Macintosh file sharing over AppleTalk. It moved to TCP/IP (port 548) in Mac OS X (2001). AFP supported Mac-specific features: resource forks, Finder metadata, file locking. Apple deprecated AFP in macOS Ventura (2022) in favor of SMB3 which gained full Apple metadata support (SMB_AAPL extensions). Netatalk (open-source AFP for Linux) continues to maintain the protocol for NAS devices.

FAQ

Should I still use AFP for Time Machine?

No. Since macOS Big Sur (11.0, 2020), Time Machine uses SMB by default. AFP Time Machine is legacy. For NAS: configure SMB shares as Time Machine destinations (fruit:time machine = yes in Samba's vfs_fruit module). For macOS server-to-server: use SMB. The only remaining AFP use case is connecting to very old Macs (pre-10.7) that don't support SMB2.

How do I migrate from AFP to SMB on a NAS?

Synology: Control Panel → File Services → disable AFP, ensure SMB is enabled with Maximum protocol = SMB3. QNAP: Control Panel → Network & File Services → disable AFP. Linux (Netatalk): stop netatalk service, configure Samba with fruit VFS module (vfs objects = fruit streams_xattr) to preserve Apple metadata. Remap clients to smb:// URLs. macOS Finder automatically falls back from afp:// to smb:// for most operations.