PowerChime.app Leaking 100+ ESTABLISHED IPv6 TCP Connections to Remote Link-Local Address

Question

Level 1

12 points

PowerChime.app Leaking 100+ ESTABLISHED IPv6 TCP Connections to Remote Link-Local Address

Hello everyone,

I'm encountering a strange and persistent network issue on my macOS system (sonoma 14.8.2) that appears to be a system-level bug causing significant connection leakage. I have performed extensive troubleshooting and verification.

I noticed an unusually high number of network connections in lsof. They all originate from the system process PowerChime.app and are stuck in the ESTABLISHED state.

Client Process: /System/Library/CoreServices/PowerChime.app (verified not tampered with via codesign).

Leak Count: Over 100 connections (and growing until the process is killed).

Client Address: My machine's link-local address: [fe80:A::B] (via interface en3).

Target Address: A specific, distinct link-local address on my network: [fe80:A::C]:49155.

Temporary Fix: Running kill <PID of PowerChime> immediately clears all connections, but the leak will likely resume after a while.

The Unanswered Questions:

I can see my en3 inet6 is fe80::A:B, what is en3, I can not do `tcpdump -i en3`.

the socket is from fe80:4:A:B, not fe80:A:B, but it seems the same address, why?

What the is PowerChime doing?

That is the netstat -rn

fe80::A:B%en3 X UHLI lo0

fe80::A:C%en3 X UHLWIi en3

The lsof result like this

PowerChim 8797 myaccount 6u IPv6 0x18af71872161233 0t0 TCP [fe80:4::A:B]:53258->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 7u IPv6 0x997e759c740f3cc 0t0 TCP [fe80:4::A:B]:53262->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 8u IPv6 0xa154905ac25e0f3 0t0 TCP [fe80:4::A:B]:53265->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 9u IPv6 0xdf10ece8d4ff1c4e 0t0 TCP [fe80:4::A:B]:53268->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 10u IPv6 0xf00d9f3eabf7fa34 0t0 TCP [fe80:4::A:B]:53271->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 11u IPv6 0x4ba561d58a25249a 0t0 TCP [fe80:4::A:B]:53274->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 12u IPv6 0x19668884d2cb62cf 0t0 TCP [fe80:4::A:B]:53277->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 13u IPv6 0xe730cd1bc3e2085b 0t0 TCP [fe80:4::A:B]:53280->[fe80:4::A:C]:49155 (ESTABLISHED)

...... many many of it

MacBook Air 13″, macOS 14.8

Posted on Dec 16, 2025 8:25 PM

Reply

Answer 1

henry4200 Author

Level 1

12 points

Dec 31, 2025 1:17 AM in response to Owl-53

Thanks for reply.

Yes, I found that each time I plug in the power adapter, the process count increases by one. Turning off the sound doesn’t help, but it can be ignored by running

defaults write com.apple.PowerChime ChimeOnNoHardware -bool true

It’s definitely a system bug anyway.

Reply

Answer 2

Owl-53

Level 10

107,199 points

Dec 31, 2025 2:23 AM in response to henry4200

henry4200 wrote:

Thanks for reply.

Yes, I found that each time I plug in the power adapter, the process count increases by one. Turning off the sound doesn’t help, but it can be ignored by running

defaults write com.apple.PowerChime ChimeOnNoHardware -bool true

It’s definitely a system bug anyway.

OP also wrote

" I'm encountering a strange and persistent network issue on my macOS system (sonoma 14.8.2) that appears to be a system-level bug causing significant connection leakage. I have performed extensive troubleshooting and verification.

I noticed an unusually high number of network connections in lsof. They all originate from the system process PowerChime.app and are stuck in the ESTABLISHED state. "

So is it now being said that they are retracting their earlier statement where " PowerChime.app " is not the source of the "persistent network issue " ?

Reply

Answer 3

Owl-53

Level 10

107,199 points

Dec 18, 2025 2:54 AM in response to henry4200

You need to look elsewhere for the " strange and persistent network issue "

On macOS 14 (Sonoma),

/System/Library/CoreServices/PowerChime.app is a built-in system app from Apple.

PowerChime.app is responsible for playing the startup/charging chime sound on Macs:

The sound you hear when:

1 - You plug in a MagSafe or power adapter

2 - (On some models/settings) when the Mac boots

3 - It’s mainly noticeable on MacBooks, especially with MagSafe.

It is an Apple-supplied system component

A - Lives in the sealed and read-only volume that can’t be opened by users or third-party applications

B - Not malware

C - Should not be deleted or modified

D - Runs only when needed (does not consume resources constantly)

System Settings

1 - System Settings → Sound

2 - Turn off:

3 - “Play sound on startup” (if present on your Mac)

Reply