I've been using Little Snitch on my Macbook and I have since a long time a rule to alert on any incoming IPv6 connection, which would be suspicious since I use IPv4 only.
Since a couple of days I've been getting regular alerts for incoming connections like this one:
When I deny the connection another alert pops up for another IPv6 address (doesn't matter if I choose once, forever, until logout, for 7 days, etc). When I open Little Snitch to look at the rules it created, each rule has a different address. Obviously I haven't tried what happens when I allow the connection.
Each time when an alert pops up, it's either rapportd that wants to accept the connection on port 49152 or sharingd on port 8770.
I have no experience with IPv6 though and have no clue where to begin to investigate beyond some basics I could think of:
- Run a scan with both MalwareBytes and KnockKnock (takes inventory of what's persistently installed on macOS and checks each item with VirusTotal): no malware found
- find the device from which the connection originates: IPv6 neighbor discovery shows no neighbors, also not when tried from a RPi connected to the same subnet.
- try to rule out that connections are coming from my iPhone, since these are both apple services: alerts keep coming when I disconnect my iPhone from wifi. Just in case I also disabled bluetooth, which makes no difference
- disable my macbook's Wifi adapter and see what happens: no more connection alerts
I'm running macOS Big Sur with all the latest updates.
Question
Any idea what this might be? I'm wondering if my machine and/or another device on my network has possibly been compromised.
What is the recommended approach for investigating a case like this?
ndpto resolve that specific address (i.e.ndp fe80:9::301e:...), or try pinging it (ping6 fe80:9::301e:...) and then tryingndp -na? The other thing that comes to mind is running a packet capture (something likesudo tcpdump -en -i en0 ip6 and tcp and ip6[53]&2!=0 and (port 49152 or 8770)', although you may have to replaceen0with whatever interface the connections are coming from). In either case, if you can find the hardware address it's coming from that'll give you a handle to track it down.ndp -naoutput indeed includes an entry after executingndpagainst that specific address; Interesting parts of the output are: 1)Linklayer Address = (Incomplete)i.e. no Mac Address, 2)Netif = awdl0which apparently is an Apple Wireless Direct Link interface, 3)Neighbor Cache State = Nostatewhich I assume is related to it not showing up initially. So still no origin unfortunately.sudo tcpdump -en -i awdl0 ip6 and tcp and ip6[53]\&2!=0 and \(port 49152 or 8770\)(had to escape some chars). I'll keep it running in the background for when it happens again. What does theip6[53]&2!=0part of the filter expression mean?