Im monitoring traffic between a Mac OS device and router. For the purpose of garnering a smaller network capture, I've just restricted activity to web browsing(Capture using Wireshark on the Mac).

The device is running through a VPN application, so all web traffic is directed toward the VPN IP as expected.

However, the device is establishing a single tcp connection through Safari, directly bypassing the VPN config.

I've tried disabling/enabling the VPN connection to see if it was just a 'glitched' tcp stream that stayed alive prior to the VPN's activation.

However, the connection continued as a TCP stream even after turning off/on the VPN config.Traffic suddenly stops for a while after this.

Things that might help to note:

  • Connection is to a cloud service(Amazon AWS)
  • Presence of a few TLS packets in the stream, but no evidence of a 3-way handshake or Connection close
  • A similar TCP has started after this one, whilst VPN is active.

Is this some default capacity of Mac OS' to initiate and/or maintain connections past VPN configurations (Data Analytics, Essential Services)? Would appreciate some insight as I am relatively new to network analysis on Macs

  • This is often dependent on the VPN app's split-tunnelling capability.
    – Tetsujin
    Dec 4, 2021 at 15:40
  • For this case the VPN application I'm using NORVPN, I don't have split tunnelling setup or configured. From reading up, seems like NordVPN doesn't have any defaultsplit tunnelling configs . Do you know any use cases where Mac OS itself might be establishing these kind of bypassed connections (i.e Apple Data Analytics).
    – N S
    Dec 4, 2021 at 15:43
  • 1
    I've Edited the title to be a bit more clear. Im trying to make sense of something that's happened, rather then ask if I could do so. Title was misleading
    – N S
    Dec 4, 2021 at 15:49
  • This isn't something I've ever had to look at, but it sounds like a task Little Snitch might be of help with. It has a free trial.
    – Tetsujin
    Dec 4, 2021 at 16:00
  • 1
    To what IP address is this connection?
    – harrymc
    Dec 4, 2021 at 17:09

1 Answer 1


Try turning off Private Relay. System Preferences->Apple ID->iCloud->iCloud Private RelayOptions...->Turn Off...


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .