Anyone used ipfw or pfctl to block an IP address range for outgoing packets?

I would like to temporarily block Apple's IP address range 17.*.*.* to find everything that's phoning home phoning home. Anyone know if Apple owns any other IP address ranges?

  • 1
    There's actually no "out" in ipfw. Technically, it's classified as "in" and "not-in." May be semantics, but there is a difference. I block traffic using inbound rules (e.g., to block FB, I use: deny ip from to any in). If you're interested in isolated traffic, netstat is a better tool to look at. To my knowledge, Apple doesn't a) spy on their users, and b) they don't own the entire block.
    – user10355
    Dec 18, 2011 at 21:19
  • 1
    I might be wrong cksum, but I am pretty sure they DO actually own the entire 17 class A ip address range. Dec 18, 2011 at 21:52
  • 1
    Apple does indeed own 17.everything, so you could use a rule like deny ip from any to to block all traffic to that. However, that's not the only address range that Apple uses. You might think about blocking apple.com at the DNS level instead/also. Dec 18, 2011 at 22:52

1 Answer 1


I highly recommend Little Snitch. Although it doesn't do anything you couldn't do with free tools, it makes monitoring, configuring, and blocking your system's outgoing traffic on a per-application basis ridiculously easy.

I'm a programmer, and one of those guys who always has a Terminal window open, and yet I still prefer using Little Snitch for this task.

It's not free, but it is cheap. And the free trial is fully functional - the only caveat is you have to manually restart it every 3 hours.

That would probably be all you need to open all your Apple-branded apps and verify whether or not they're phoning the mothership.

And if they are phoning any address outside the 17.x.x.x range, you'd learn that really quick.

  • I would worry that a closed source tool like Little Snitch already ignores traffic it's authors deemed unimportant. I've used Little Snitch's free version for evaluating non-Apple software before though. Dec 19, 2011 at 1:51
  • 1
    +1 anyways, always good when people mention user friendly tools that help expose apps phoning home. Dec 19, 2011 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .