# WHATPORT(5009)

## NAME

port 5009 — AirPort admin (registered as winfs) — Apple AirPort base station administration — the port AirPort Utility configures the router on.

Protocol: TCP  
IANA registry

## DESCRIPTION

The IANA registration for 5009 is winfs, "Microsoft Windows Filesystem", which you will essentially never meet. What actually answers is Apple's base station admin service: AirPort Utility talks to an AirPort Express, Extreme, or Time Capsule on TCP 5009 to read and write its configuration. Apple discontinued the AirPort line in 2018, so a listener today is an old base station still in service — and the port is a reliable fingerprint for one.

## EXPOSURE

**Do not expose.** This is the router's configuration plane on hardware that stopped receiving firmware updates. It belongs on the LAN only; never enable base-station administration from the WAN side.

## CHECK

```sh
nc -vz TARGET 5009
```

## SEE ALSO

- iana — [IANA port registry — 5009 (winfs)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5009) (iana.org)
- source — [nmap-services — 5009/tcp airport-admin](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/5009/> · JSON: <https://whatport.net/5009.json> · full dataset: <https://whatport.net/ports.json>