I got a suspicious alert on litte snitch today which I captured in a screenshot. I am sending it to you. Could you please take a look and tell whether you think my mac got infected or not?

I installed Clear VPN through my Setapp subscription last week and it asked for my keychain password. I am not really informed on keychain access and security. I was even less informed last week. I reset the password for keychain and entered it in the Clear VPN App and then got this suspicious alert on MacOS Kernel. I then tried to restore from a time machine backup, which seemed to help (this was a couple of days earlier). But today I got this alert once again. I blocked it. However, I have a feeling that this is not good.

Maybe the installation of clear VPN and keychain password isn't related to this alert. I don't know. If anyone does, could you please help me with this and shed some light on the matter?

Big Sur 11.0.1 Little Snitch 5.0.3 Screenshot

  • I am curious about your network/internet connection setup. Are you connected to a home wifi network? Plugged in directly to the cable modem? etc. I think @Allan is correct in his answer below - there's nothing to worry about, I am just curious.
    – negacao
    Commented Nov 30, 2020 at 17:19
  • -> e244-179.eduroam.tuwien.ac.at This time, I am in Austria and "eduroam.tuwien.ac.at" - eduroam is the name of the wifi available on the universities in Vienna and tuwien.ac.at is the domain of our university. Last time though the IP was from something like Ukraine or Russia.
    – Orkhan
    Commented Nov 30, 2020 at 18:22

2 Answers 2


There's nothing there that indicates being "hacked."

Too often, folks see connections or random behavior and immediately assume this is a hacking attempt. It's not.

This could be any number of legitimate connection attempts especially given that the IP in question isn't flagged as coming from a known hacking IP, one of the many rogue countries (like China) or from a remote, anonymous proxy.

Now, you shouldn't be getting connections like this directly to the kernel especially if you are behind a firewall. However, if your Mac sends a request out and creates a "state" on your firewall, it can connect back - making this entirely legitimate.

  • Ensure you're behind a proper firewall
  • Turn on the firewall on the Mac
  • Log outgoing connections in Little Snitch to correlate traffic

Bottom line...a single connection is not enough to determine anything. You need to see this in context and you need to see the actual traffic that's incoming. If you're not using firewalls, your very first action is to get behind one and/or turn it on.

  • 1
    The firewall is on. As I commented above this time ip is from my area but the last time it was from either Ukraine or Russia. That's why I got suspious.
    – Orkhan
    Commented Nov 30, 2020 at 18:26
  • 1
    If you were overseas like in the US or in Australia, that would be concerning, but since Russia and the Ukraine is in the same general geographic region, it is entirely possible you're connecting to a legitimate, regional service. The key is to see what specific data, in context, is being sent/received. You should have a firewall on your network and not rely on the firewall on your computer.
    – Allan
    Commented Nov 30, 2020 at 19:28

I believe this is a real hack attempt targeting a BitTorrent listener on port 6881. I witnessed such an attempt recently from a malicious source IP, identified as a VPN client located in Zurich. Most likely, your firewall has port forwarding enabled on port 6881 to the machine running Little Snitch, prompting the alert. Whether or not a torrent service is running on the Mac, you'd see the alert from Little Snitch when the connection is attempted.

To check if your Mac is actually listening on port 6881 and see the application and PID responsible for it, run a command in the terminal (netstat on Mac will not show the process name and PID, a limitation of netstat on the mac, so we use this instead):

lsof -i -P | grep -i listen

If Little Snitch hadn't stopped the attempt, it's reasonable to assume the connection would be dropped, since there is nothing listening on port 6881... unless there is something listening on port 6881 in your case, such as when running a torrent client.

You can disable port 6881 at the firewall when you don't need it, or better yet use a different port as a listener, so that you are less likely to be targeted. Hopefully modern Macs block connections to the kernel without the use of Little Snitch. It would be a major vulnerability if it were allowed by the operating system. I had a difficult time finding information online describing such an attack or what operating systems would be vulnerable.

  • is in Vienna, not in Zurich.
    – nohillside
    Commented Apr 24, 2022 at 14:50
  • Zurich referenced the seedy source that I mentioned in what I observed in a separate incident. It did not refer to the example provided in the question.
    – Jer
    Commented Apr 25, 2022 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .