{
  "port": 5009,
  "protocol": "tcp",
  "service": "AirPort admin (registered as winfs)",
  "oneLiner": "Apple AirPort base station administration — the port AirPort Utility configures the router on.",
  "whatItIs": "The IANA registration for 5009 is winfs, \"Microsoft Windows Filesystem\", which you will essentially never meet. What actually answers is Apple's base station admin service: AirPort Utility talks to an AirPort Express, Extreme, or Time Capsule on TCP 5009 to read and write its configuration. Apple discontinued the AirPort line in 2018, so a listener today is an old base station still in service — and the port is a reliable fingerprint for one.",
  "exposure": {
    "verdict": "never",
    "note": "This is the router's configuration plane on hardware that stopped receiving firmware updates. It belongs on the LAN only; never enable base-station administration from the WAN side."
  },
  "checkCommand": "nc -vz TARGET 5009",
  "links": [
    {
      "title": "IANA port registry — 5009 (winfs)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5009",
      "kind": "iana"
    },
    {
      "title": "nmap-services — 5009/tcp airport-admin",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}