0

My wifi card is trying to make a connection to a seemingly random IP address on the local network. The Mac Mini 2011 is connected to the local network via Wifi. I completed a fresh re-install of MacOS High Sierra from USB and the wifi card still tries to make this connection.

Packet capture of network traffic with Wireshark shows that the network card is calling out roughly every 1 minute 30 seconds, attempting to make a connection to an IP on the local network (192.168.86.173, Port 7000) by sending a SYN packet. Then several re-transmissions of the SYN take place, since there is no response from the IP the client is trying to reach.

I have ping and nmap the IP 192.168.86.173, but no response. I have used network scanner and no device shows on that IP.

I looked up port 7000 and only found a file-server that uses UDP, not TCP. (https://www.auditmypc.com/tcp-port-7000.asp), and something called Gryphon for automobile testing that uses TCP (http://www.networksorcery.com/enp/protocol/ip/ports07000.htm).

Does anyone know what is causing this? Why would this be persistent after a fresh reinstall?

4
  • You should be able to find out what process is trying to make a connection with udo lsof -i:7000. Also, if it's sending SYN packets, something must be responding to ARP; try arp 192.168.86.173 and see what you get. BTW, what exactly do you mean by a "fresh reinstall"? Oct 4, 2020 at 2:23
  • By fresh reinstall I mean a full reinstall after erasing the drive and by using time machine backups or without erasing the drive. Oct 4, 2020 at 2:28
  • I tracked the process down using command netstat -anvt | grep SYN_SENT and found the PID. I checked the PID using ps -ax | grep $PID. That resolved to AirPlayXPCHelper. Now I'm wondering why AirPlayXPCHelper checks that particular IP address. Answer: apple.stackexchange.com/questions/217253/… Oct 4, 2020 at 18:24
  • I'm not on a CIDR /24 network. I'm on a CIDR /16. So, the address it's checking is on the LAN. However, I'm still curious why that particular address since it was persistent after a complete reinstall. Oct 4, 2020 at 18:38

0

You must log in to answer this question.

Browse other questions tagged .