Little Snitch reports outgoing connections for AirPlayXPCHelper for wrong subnets?

Question

After upgrading to El Capitan, I've started noticing annoying connections from the AirPlayXPCHelper to 192.168.1.0/24 subnet (my home network isn't in 192.168.1.0/24 subnet, it's in 172.16.0.0/12 subnet).

Questions are:

1. Why AirPlayXPCHelper goes out to this network on port 5000 and 7000?
2. Is there a way to limit it's desire to go there?

Thank you.

Answer 1

I had this exact same issue where Little Snitch detected external AirPlayXPCHelper traffic on port 7000 but treated it as internal traffic. What I mean is that even though I had all external traffic marked as deny, Little Snitch continued to prompt me on each connection attempt until I set it to deny local traffic (just for testing purposes), obviously I do not want to deny local traffic on this port... I do not understand why Little Snitch is interpreting this as local traffic (when the address is not in the local DHCP scope), a bug with Little Snitch perhaps?

When I read a post about AirPlay it got me thinking about how AirPlay technology works, as it now uses bluetooth to establish connections between devices. I was unable to repeat the issue with local connections enabled and bluetooth disabled.

Long story short I am now convinced this is simply a bug in Little Snitch and not someone trying to hack into my network. Blocking local connection or disabling bluetooth are the only ways I can permanently stop attempts.

The bluetooth traffic is coming from an AirPlay enabled device somewhere near your computer. Maybe a next door neighbours AppleTV?

Answer 2

This question will help you disable the root cause of the problem.

If you're the curious type, I'd fire up WireShark somewhere and see if the Mac is actually sending out packets on those ports to those addresses. It may be that AirPlay has assigned itself an interface and is using it as a loop back or otherwise.