2

OS: macOS 10.13.5 High Sierra; HW: Mid-2010 MacBookPro7,1 13” 2.66GHz Core 2 Duo

I am interested in blocking incoming connections to Apple’s two persistent daemons with internet-facing open ports—specifically apsd and rapportd (pid 276 & 317 respectively below):

$ netstat -avp tcp
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)     rhiwat shiwat    pid   epid
tcp4       0      0  192.168.0.2.49271      17.252.28.71.5223      ESTABLISHED 131072 131072    276      0
tcp4       0      0  localhost.ipp          *.*                    LISTEN      131072 131072    470      0
tcp6       0      0  localhost.ipp          *.*                    LISTEN      131072 131072    470      0
tcp6       0      0  *.49157                *.*                    LISTEN      131072 131072    317      0
tcp4       0      0  *.49157                *.*                    LISTEN      131072 131072    317      0

Using the Application Layer Firewall control daemon (socketfilterfw), I have added and then instructed the firewall to block incoming connections to both daemons as indicated here:

$ socketfilterfw --listapps
ALF: total number of apps = 2 

1 :  /usr/libexec/rapportd 
     ( Block incoming connections ) 

2 :  /System/Library/PrivateFrameworks/ApplePushService.framework/apsd 
     ( Block incoming connections )

The machine was then rebooted.

However, using Activity Monitor—>Network, it indicates that apsd is still receiving packets and as netstat above displays, it maintains an ESTABLISHED connection state. I am not proficient enough to verify blocking of rapportd, as it is perpetually in LISTEN state and never seems to receive data, but since its active buddy doesn’t appear blocked, I doubt that it is as well.

I know there are other routes to disabling these services (launchd/lingon, pf/murus, afw/vallum), but would prefer to resolve it through ALF/socketfilterfw if possible, if for no other reason than I would like to understand exactly why it doesn’t seem to work as advertised.

Than you all for your guidance in resolving this conundrum.

Bonus ’tard question: How do I log out of this site? The place is like Hotel California—I can’t seem to find the logout link, LOL!

  • 1
    Logging out: click the triple-bar icon in the upper right and then "log out" from the menu that pops down. – user1258361 Jun 4 '18 at 20:02

You must log in to answer this question.

Browse other questions tagged .