outbound connections via port 7000 to 172.254.254.0 ips
Does anyone know about any legacy applications or MacOS built-in functions that are hard-coded to an IP range via Port 7000?
I've been researching that Airplay can do remote connections via this method. It doesn't appear to be Airplay related.
We've dumped the installed apps, but nothing appears to be related.
The strange aspect is that the destination IP address is in the 172.254.254.0/24 range, primarily two IP's; 172.254.254.45 & 172.254.254.239.
It was originally owned by the legacy Roadrunner ISP now owned by Charter Communications and then smaller subnet delegated to other entities.
This fact creates a hunch that it's related to some legacy application/process that was sources at that IP back when it was the RoadRunner ISP...
We are primarily seeing a couple of MacOS devices attempting these connections, but we have seen iOS devices also.
If we sniff the packets with wireshark or network devices - there's nothing that provides any indication of use/purpose.
Current Pro Desktops
