0

I have a Linux machine with Psad installed. When I observe the log reports generated (admittedly I have Psad configured to be particularly sensitive), it lists a large number of scans originating from my Apple MacBook-air (OS X 10.11.6), directed towards the multicast address 224.0.0.1.

This is not the only Apple device on my local network, however it is unique in it's network activity in this regard, and I am curious why.

Below is a nmap scan list of services from the offending Mac, in case it provides any relevant details.

Not shown: 995 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
445/tcp   open  microsoft-ds
548/tcp   open  afp
625/tcp   open  apple-xsrvr-admin
49152/tcp open  unknown

In short: Why would my MacBook-Air be repeatedly scanning the multicast address 224.0.0.1, and therefor all addresses on the local subnet?

Thanks in advance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.