After upgrading to El Capitan, I've started noticing annoying connections from the AirPlayXPCHelper to subnet (my home network isn't in subnet, it's in subnet).

Questions are:

  1. Why AirPlayXPCHelper goes out to this network on port 5000 and 7000?
  2. Is there a way to limit it's desire to go there?

Thank you.

  • Anything on the 192.168 network it may be interested in connecting to? Nov 26, 2015 at 20:53
  • Not really. There is network from the cable modem, but nothing in the range. Not even VPN.
    – sashk
    Nov 27, 2015 at 0:52
  • Since AirPlay is meant to work together with the AirPort Express base station, which default address range is at 192.168.1.x/24, it is possible that this is used by the helper to try to get responses from such base stations.
    – Phoenix
    Nov 27, 2015 at 11:22
  • @Phoenix isn't is default for Airport?
    – sashk
    Nov 27, 2015 at 14:10
  • 1
    There are 3 networks configurable: 10.0.x.x/24, 172.16.x.x/24 and 192.168.x.x/24. The third octet defaults to 1, but can be configured freely to anything from 0-255. If I'm not mistaken, it used to be 10.0.x.x/24 and got changed to 192.168.x.x/24 in later firmware versions. Since I have not defaulted my devices for a very long time, I'm not 100% sure though.
    – Phoenix
    Nov 27, 2015 at 14:29

5 Answers 5


Time to answer my own question:

Why AirPlayXPCHelper goes out to this network on port 5000 and 7000?

This is related to the Peer-to-Peer AirPlay and Airplay device discovery. macOS discovers new device and attempts to connect using these ports to finish (?) discovery process.

Couple of my neighbours got new AppleTV and macOS attempts to connect to them. As all AppleTVs are connected to the different networks, it attempts to connect to each of them and it is what Little Snitch reports.

Is there a way to limit its desire to go there?

I'm not aware of any. I just blocked access for AirPlayXPCHelper to networks other than mine using Little Snitch.


This happened to me too so I dug into it. See Apple docs on Airplay Discovery https://support.apple.com/guide/deployment-reference-macos/airplay-discovery-apd19d206cc7/1/web/1.0

I'll refer to a neighbor's device as an "alien" device to emphasize you don't want to connect to it, and that it is not on your local network. (It could broadcast a public address, but that's not what is concerning people here.)

The alien device broadcasts its IP by Bonjour, peer-to-peer, or Bluetooth. Assuming your network is even moderately secure, the Mac isn't getting the alien address via Bonjour. Perhaps your Mac is getting the IP by peer-to-peer wifi but most likely your Mac is getting the alien IP via Bluetooth.

You could turn off Bluetooth to avoid this but some need it on. I see no way on the Mac to say to ignore these broadcasts except for particular networks or to disable AirPlay discovery.

Once your Mac gets the alien device's IP address, your Mac tries to reach out over its regular network (wireless or wired) to the IP. If it can't get there (because it is on a private address different than yours), no harm (except that Little Snitch noticed it).

Even if the alien device broadcasts an IP that you can get to, suppose even the same IP as your real Airplay speakers/TV use, I understand the AES encoding of Airplay basically requires a pre-shared key. Unless you've set that up, it won't talk to them. If you did set it up, then your Mac already knows about your particular speakers/TV and there is no harm with it finding them again.

As for the case that you can get to the alien device via a public IP. If it doesn't have the right pre-shared key, the Airplay AES encoding will keep the alien device from understanding what you send it.

It was scary to me to see this alien network show up, but it seems that this doesn't represent anything more serious than unnecessary alarms. Tell Little Snitch to silently block anything not on your local nets.

  • The docs are now at support.apple.com/guide/deployment/use-airplay-dep9151c4ace/web [quote]When looking for other devices, an Apple device broadcasts a very small Bluetooth advertisement indicating that it’s looking for peer-to-peer services. When any peer-to-peer-capable device hears this BTLE packet, it creates or joins a peer-to-peer network directly between the devices. The devices concurrently switch between this temporary network and any infrastructure networks they were on before in order to deliver both the AirPlay video stream and provide existing internet service. [/quote]
    – M T
    Dec 18, 2021 at 19:41

I had this exact same issue where Little Snitch detected external AirPlayXPCHelper traffic on port 7000 but treated it as internal traffic. What I mean is that even though I had all external traffic marked as deny, Little Snitch continued to prompt me on each connection attempt until I set it to deny local traffic (just for testing purposes), obviously I do not want to deny local traffic on this port... I do not understand why Little Snitch is interpreting this as local traffic (when the address is not in the local DHCP scope), a bug with Little Snitch perhaps?

When I read a post about AirPlay it got me thinking about how AirPlay technology works, as it now uses bluetooth to establish connections between devices. I was unable to repeat the issue with local connections enabled and bluetooth disabled.

Long story short I am now convinced this is simply a bug in Little Snitch and not someone trying to hack into my network. Blocking local connection or disabling bluetooth are the only ways I can permanently stop attempts.

The bluetooth traffic is coming from an AirPlay enabled device somewhere near your computer. Maybe a next door neighbours AppleTV?

  • 1
    I don't see how this is an answer to the question and not another question entirely. Consider rewriting it so it answers the question or if you have another question, rewrite it and post it as a new question.
    – Allan
    Apr 27, 2016 at 11:24

This question will help you disable the root cause of the problem.

If you're the curious type, I'd fire up WireShark somewhere and see if the Mac is actually sending out packets on those ports to those addresses. It may be that AirPlay has assigned itself an interface and is using it as a loop back or otherwise.

  • 3
    I don't want to disable AirPlay, but I want to get better understanding why it attempts to connect to subnets which are not in my network. I was looking at Wireshark dump, but did not see anything interesting. I should have mentioned this in my question.
    – sashk
    Nov 27, 2015 at 6:19

I performed a traceroute and discovered that the request appears to have originated from the other side of my ISP gateway.

  • My Edge Firewall
  • My on-prem ISP Modem
  • ISP Gateway
  • ( 9.921 ms 148.842 ms 10.342 ms

I added a new firewall rule on my edge firewall (and not through Little Snitch) to block inbound requests. It seems to be no longer an issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .