While working on other networking issues, I discovered my Mac, running El Capitan, was trying to make a TCP connection to 10.0.1.2:7000. What is trying to make that connection, why, and how do I turn it off?
Note: 10.0.1.2 is a "private" IPv4 address and should not be used by any site on the internet. None of our local networks use anything on 10.x.x.x, they are in other private subnet ranges.
Also note: the Mac is trying to initiate this outgoing connection. There is no inbound traffic. netstat shows nothing listening on 10.0.1.2:7000 (and indeed the traffic is being forwarded to a router, which is how I discovered it) and I have not been able to get lsof to show me any information about it.
Update/Answer
Not really a duplicate of the linked question (that question was about LittleSnitch and why it was complaining, and problems with its filtering rules regarding local networks), but related to the same issue. I would prefer to post the following as an answer but cannot while this is closed as duplicate.
Using tcpdump -k NP (from this answer) as suggested by klanomath confirmed that this is coming from AirPlayXPCHelper. This web page provides a list of AirPlay related ports. In particular, port 7000 is used for AirPlay Video, 5000 for Audio, and 5001 for Audio-related Events.
