{
  "port": 7000,
  "protocol": "tcp",
  "service": "AirPlay receiver",
  "oneLiner": "An AirPlay receiver: an Apple TV, HomePod, AirPlay-capable TV, or a Mac with AirPlay Receiver turned on.",
  "whatItIs": "Apple's AirPlay control channel listens on TCP 7000; the device advertises itself over mDNS (_airplay._tcp) and clients then talk HTTP-ish RTSP to this port to negotiate screen mirroring and audio streaming. It turns up on home-network scans from Apple TVs, HomePods, and third-party TVs with AirPlay 2, and on Macs since macOS Monterey where AirPlay Receiver is a Sharing toggle. Note that IANA registers 7000 to afs3-fileserver, not to Apple, so the registry name on your scanner output is usually wrong here.",
  "exposure": {
    "verdict": "never",
    "note": "AirPlay is a LAN protocol with weak-to-optional pairing and has had a run of remote code execution bugs (the 2025 AirBorne set), so it has no business being reachable from the internet."
  },
  "checkCommand": "curl -s -m 3 http://TARGET:7000/info | head -c 200",
  "links": [
    {
      "title": "Apple — TCP and UDP ports used by Apple software products (7000 = AirPlay)",
      "url": "https://support.apple.com/en-us/103229",
      "kind": "official-docs"
    },
    {
      "title": "openairplay/airplay-spec — unofficial AirPlay protocol specification",
      "url": "https://github.com/openairplay/airplay-spec",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 7000 (registered as afs3-fileserver)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=7000",
      "kind": "iana"
    }
  ],
  "ianaName": "afs3-fileserver"
}