macOS Ports#
Historical OSX / macOS services and ports across all versions. The operator hits the most common Apple-specific listeners during scan triage.
Selected ports#
Port |
Proto |
App |
Service |
|---|---|---|---|
22 |
TCP |
ssh |
Xcode Server (Git+SSH; SVN+SSH) |
88 |
TCP |
kerberos |
Kerberos, Screen Sharing authentication |
106 |
TCP |
3com-tsmux |
macOS Server Password Server |
192 |
UDP |
osu-nms |
AirPort Base Station discovery, AirPort Admin / Express Assistant |
311 |
TCP |
asip-webadmin |
Server app, Workgroup Manager, Xsan Admin |
312 |
TCP |
vslmp |
Xsan Admin (10.8 and later) |
389 |
TCP |
ldap |
Mail, Address Book |
427 |
TCP / UDP |
svrloc |
Network Browser |
443 |
TCP |
https |
TLS websites |
445 |
TCP |
microsoft-ds |
SMB over TCP/IP |
500 |
UDP |
isakmp / IKEv2 |
macOS Server VPN, Wi-Fi calling |
548 |
TCP |
afpovertcp |
AppleShare, Personal File Sharing, AFS |
554 |
TCP / UDP |
rtsp |
AirPlay, QuickTime Streaming |
587 |
TCP |
submission |
Mail submission, iCloud mail |
600-1023 |
TCP / UDP |
ipcserver |
NetInfo |
623 |
UDP |
asf-rmcp |
Lights Out Monitoring (LOM) |
625 |
TCP |
dec_dlm |
Open Directory, Workgroup Manager |
626 |
TCP / UDP |
asia |
IMAP admin, server serial number registration |
631 |
TCP |
ipp |
macOS Printer Sharing |
636 |
TCP |
ldaps |
Secure LDAP |
660 |
TCP |
mac-srvr-admin |
Server admin tools (10.4 and earlier) |
687 |
TCP |
asipregistry |
Server admin tools (10.6 and earlier) |
749 |
TCP / UDP |
kerberos-adm |
Kerberos 5 admin |
985 |
TCP |
NetInfo Static Port |
|
1701 |
UDP |
l2f |
macOS Server VPN |
1723 |
TCP |
pptp |
macOS Server VPN |
1900 |
UDP |
ssdp |
Bonjour |
2049 |
TCP / UDP |
nfsd |
NFS |
2195-2197 |
TCP |
Push notifications and feedback |
|
3031 |
TCP / UDP |
eppc |
Program Linking, Remote Apple Events |
3283 |
TCP / UDP |
net-assistant |
Apple Remote Desktop 2.0+ |
3306 |
TCP |
mysql |
MySQL |
3478-3497 |
UDP |
nat-stun / ipether232 |
FaceTime, Game Center |
3659 |
TCP / UDP |
apple-sasl |
macOS Server Password Server |
3689 |
TCP |
daap |
iTunes Music Sharing, AirPlay |
5009 |
TCP |
winfs |
AirPort Utility, AirPort Express Assistant |
5100 |
TCP |
socalia |
Camera and scanner sharing |
5222 / 5223 |
TCP |
jabber-client |
Jabber, iMessage, Game Center, Photo Stream |
5228 |
TCP |
Spotlight Suggestions, Siri |
|
5297 |
TCP |
Messages (local traffic) |
|
5350 / 5351 |
UDP |
nat-pmp |
Bonjour |
5353 |
UDP |
mdns |
Bonjour, AirPlay, Home Sharing |
5432 |
TCP |
postgresql |
PostgreSQL (ARD database) |
5900 |
TCP |
vnc-server |
Screen Sharing (10.5 and later) |
6970-9999 |
UDP |
QuickTime Streaming Server |
|
7070 |
TCP / UDP |
arcp |
QuickTime Streaming Server (RTSP) |
8008 / 8080 |
TCP |
http-alt |
macOS Server, JBoss HTTP |
8443 |
TCP |
pcsync-https |
JBoss HTTPS |
9100 |
TCP |
Network printer |
|
9418 |
TCP / UDP |
git |
Xcode Server (remote git) |
10548 |
TCP |
serverdocs |
macOS Server iOS file sharing |
11211 |
Calendar Server |
||
16080 |
TCP |
Web service with performance cache |
The full table runs across pages 182-187 of the source handbook. The entries above cover services the operator hits during routine scans of macOS estates.