I'm seeing large spikes in packets in/packets out periodically in my Activity Monitor for my Mac Studio. They don't seem be to realistic. Is this a bug with the software itself? I don't believe it's really getting 17,293,193,664,310,237,000 packets in and out symmetrically.
Mac Studio, macOS 15.5
I appreciate everyone's attention to this. It turns out the culprit was rapportd trying to talk to an ipad. Turning off the ipad (and letting rapportd settle down, I guess it persists trying to call out for a while if the network is down?) for several minutes made the problem go away.
In case anyone runs across this, I was able to correlate the spikes by looking at `iftop` output (which tracked to mdns.mcast.net going to the ipad IP), `netstat` to see what was trying to get to the IP, and `sudo fs_usage -w -f network rapportd` to confirm the bursts of activity
There's clearly something wrong with the packet accounting somewhere between rapportd and Activity Monitor for some reason, but local network traffic was the cause. Given the large numbers, I wouldn't be surprised if it was related to some bitwise operation error (max 64bit unsigned is 18e18 and it was showing 17e18, not close enough for me to believe it was an underflow).
I appreciate everyone's attention to this. It turns out the culprit was rapportd trying to talk to an ipad. Turning off the ipad (and letting rapportd settle down, I guess it persists trying to call out for a while if the network is down?) for several minutes made the problem go away.
In case anyone runs across this, I was able to correlate the spikes by looking at `iftop` output (which tracked to mdns.mcast.net going to the ipad IP), `netstat` to see what was trying to get to the IP, and `sudo fs_usage -w -f network rapportd` to confirm the bursts of activity
There's clearly something wrong with the packet accounting somewhere between rapportd and Activity Monitor for some reason, but local network traffic was the cause. Given the large numbers, I wouldn't be surprised if it was related to some bitwise operation error (max 64bit unsigned is 18e18 and it was showing 17e18, not close enough for me to believe it was an underflow).
17 quintillion anything? Yeah, no. There’s a math error here somewhere.
Can you monitor from your Wi-Fi router or access point, switch, or gateway box?
Any add-on “coffee shop” VPN apps active here?
emptyjar9283 wrote:
I have a work-related vpn that is currently not running as a loaded process. The issue also is not present on a laptop with the same vpn (running or otherwise).
Are these VPNs used for directly connecting into and accessing your organization’s own internal network (and your local computer seems to join the internal network), or are these VPNs intended to protect the first part of your network connection into publicly-accessible websites?
Whichever sort of VPN, remove the add-on VPNs, and see if the issue repeats.
If the issue repeats and it’s the former type of VPN, then his is a discussion with your IT and the organization supporting the VPN. If this is the latter sort of VPN, those tend to be a security and privacy mess. At best.
emptyjar9283 wrote:
I'm seeing large spikes in packets in/packets out periodically in my Activity Monitor for my Mac Studio. They don't seem be to realistic. Is this a bug with the software itself? I don't believe it's really getting 17,293,193,664,310,237,000 packets in and out symmetrically.
https://discussions.apple.com/content/attachment/5a20ee7b-0370-4858-8485-5a1776c8e6ad
is there some associated issue?
why fixate on Activity Monitor...
what do you see for top Process Name....(?) pick you sort by
The issue is the graph is completely useless for monitoring traffic and it's also not something I've experienced elsewhere.
I've not got any weird VPN software running that I would be suspicious of. The actual network activity is fine and the issue persists if I turn off all networking/power down routers/disconnect cables. I've also rebooted. Top programs (I've confirmed it's also not the browser)
emptyjar9283 wrote:
I've not got any weird VPN software running that I would be suspicious of.
Public VPN's are anything but private or safe
https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://gist.github.com/joepie91/5a9909939e6ce7d09e29
https://www.eccu.edu/blog/cybersecurity/5-reasons-why-you-should-not-use-free-vpns/
https://krebsonsecurity.com/2024/05/is-your-computer-part-of-the-largest-botnet-ever/
https://www.pcmag.com/news/the-feds-have-some-advice-for-highly-targeted-individuals-dont-use-a-vpn
I’m not sure how to interpret the “I've not got any weird VPN software running that I would be suspicious of.” Does that mean no add-on VPNs are present, or only VPNs you believe non-weird?
I have a work-related vpn that is currently not running as a loaded process. The issue also is not present on a laptop with the same vpn (running or otherwise).
👍🏽
Large packet spikes in Activity Monitor
