0

I am trying to figure out what is wrong with my Mac.

Here are my devices:

  1. iPad (7th generation, MW752LL/A) with iOS 14.01 (18A393)

  2. iPad Air (MD788LL/A) with iOS 12.4.8 (16G201)

  3. iPhone 6 Plus (MGCW2LL/A) with iOS 12.4.8 (16G201)

  4. Mac mini (Mid 2011) with macOS Catalina 10.15.7 (using macOS Catalina Patcher from dosdude1.com)

All devices are connected to the network/Internet via the same Wi-Fi router. But the Mac’s connection is wired (Ethernet Cat5 cable).

Issue:

My first finding: After turning off the Mac’s Ethernet (see pic1), I still am be able to access all my three iDevices via Finder. I am able to transfer files to and copy from all my three iDevices. If I physically disconnected the Cat5 cable then I will not be able to access the three iDevices. But once I reconnected the Cat5 cable, I one again am be able to access those three iDevices via Finder. All these while my Mac’s network was off. I could confirm that while my Mac’s network was off, none of my applications (Safari, App Store, or any third party apps) were able to access the Internet.

So, I sent an email to Apple product-security email. I got a response back a day later saying that “Regarding the issue you reported, we have examined it and determined that it is best addressed via Apple's Support resources which may be found at https://www.apple.com/support/.“ and another link to AppleCare site.

I assumed that they were telling me this issue is unique to my system.

So I decided to dig in. My first intuitively suspicious is Xcode would have the same phenomenon because it probably used the same mechanism to accessing iDevices. I carried out testing with Xcode and it indeed expressed the same behavior.

Next I wanted to eliminate this uncertainty: Using macOS Catalina Patcher from dosdue1. I installed macOS High Sierra (latest 10.13.6) into an external USB drive. With this setup, my Mac system should be conformed to Apple’s for the Mac mini Mid 2011 with proper MacOS at the time it was still being supported. The Finder under macOS High Sierra does not support accessing iDevices via WiFi yet. But Xcode does. And I discovered that Xcode also has this phenomenon as described earlier. To minimize any possibility of cross contamination or from Internet, while in macOS High Sierra, I did not install any software other than Apple’s security latest update. But I did goto Apple’s developer site to download Xcode 10. And I did boot back to Catalina to export my Xcode certificate so to import into the new Xcode under macOS High Sierra.

Here are my conclusion: Do you agree?

  1. This phenomenon could not and should not be the norm.

  2. This phenomenon is not caused by using macOS Catalina Patcher from dosdue1.

  3. Let’s assume that my Mac’s hardware (Ethernet) was outdated for Catalina. But under High Sierra, Xcode has the same symptoms.

  4. What is possibility of my Mac's firmware has been compromised?

Since I do not plan to get a current Mac. So I would not be able to determine if any current support Mac hardware experienced this phenomenon.

Any comments?

Edited1: showing ifconfig as requested. Note: I changed the MAC addresses.

Edited2: It seemed like if I turn off IP6 on the Mac then this phenomenon is gone. I got the hint from the ifconfig listing in that IP6 address was still available while IP4 address has gone when the network is off.

Edited 3: After further investigation with hints from comments, I discovered that IP6 was still active even after one turned off the Ethernet as in Network Preferences. Because IP6 was located in another menu: “Advanced…”. If one goes into the this Advanced… menu, the IPv6 is in a separate dropdown (pic2). The only way to turn off the network completely is to go into the Advanced… menu to select Configure IPv6 as Manually (pic3) and leave all fields blank.

So my conclusion is this was by design. That is fine. Except this is misleading. In the Network window (pic1) the Ethernet indicator light is red when you turned off Configure IPv4 while IPv6 is still active. In my opinion, this should not be the case. Simply, this indicator light is for the Ethernet connection: Both IPv4 and IPv6. Unless Apple decided IPv6 is not part of Ethernet. In that case it needs to create another indicator light.

And Finder and Xcode do use IPv6.

enter image description here

enter image description here

enter image description here

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
EHC250: flags=0<> mtu 0
EHC253: flags=0<> mtu 0
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
    ether xx:xx:xx:xx:xx:xx  
    inet6 fe80::1469:5fff:c541:b802%en0 prefixlen 64 secured scopeid 0x6 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (1000baseT <full-duplex,flow-control,energy-efficient-ethernet>)
    status: active
en1: flags=8823<UP,BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
    options=400<CHANNEL_IO>
    ether zz:zz:zz:zz:zz:zz 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect (<unknown type>)
    status: inactive
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=460<TSO4,TSO6,CHANNEL_IO>
    ether yy:yy:yy:yy:yy:yy  
    media: autoselect <full-duplex>
    status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
    lladdr ww:ww:ww:ww:ww:ww:ww:ww 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect <full-duplex>
    status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=63<RXCSUM,TXCSUM,TSO4,TSO6>
    ether yy:yy:yy:yy:yy:yy  
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x0
    member: en2 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 8 priority 0 path cost 0
    nd6 options=201<PERFORMNUD,DAD>
    media: <unknown type>
    status: inactive
p2p0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 2304
    options=400<CHANNEL_IO>
    ether qq:qq:qq:qq:qq:qq  
    media: autoselect
    status: inactive
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::97b1:8eb0:7f61:8f08%utun0 prefixlen 64 scopeid 0xc 
    nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
    inet6 fe80::eedc:91d7:6a3f:2623%utun1 prefixlen 64 scopeid 0xd 
    nd6 options=201<PERFORMNUD,DAD>
7
  • Was bluetooth turned on ? – anki Nov 1 '20 at 14:46
  • Open Terminal and issue the command: ifconfig and copy / paste the results here while Ethernet is off but cable is connected. – James Brickley Nov 1 '20 at 14:54
  • @JamesBrickley: done – com ter Nov 1 '20 at 16:14
  • 1
    @comter The ethernet is not off in the paste you've added.. it specifically states that ethernet is UP (active). Run "ifconfig en0 down" and try again to see what your results are. – jksoegaard Nov 1 '20 at 20:06
  • In the screenshot you posted it looks as if Firewire is selected (albeit in gray) on the left while the details for Wi-Fi are given on the right - is this actually the behaviour in your system preferences? Also: why does the fact that your own Mac can communicate with your own iPhone and iPad (while its network is supposedly "turned off") make you think of malware or "compromised" firmware? – Asmus Nov 2 '20 at 6:55

You must log in to answer this question.

Browse other questions tagged .