PowerChime.app Leaking 100+ ESTABLISHED IPv6 TCP Connections to Remote Link-Local Address

Hello everyone,


I'm encountering a strange and persistent network issue on my macOS system (sonoma 14.8.2) that appears to be a system-level bug causing significant connection leakage. I have performed extensive troubleshooting and verification.


I noticed an unusually high number of network connections in lsof. They all originate from the system process PowerChime.app and are stuck in the ESTABLISHED state.


Client Process: /System/Library/CoreServices/PowerChime.app (verified not tampered with via codesign).

Leak Count: Over 100 connections (and growing until the process is killed).

Client Address: My machine's link-local address: [fe80:A::B] (via interface en3).

Target Address: A specific, distinct link-local address on my network: [fe80:A::C]:49155.


Temporary Fix: Running kill <PID of PowerChime> immediately clears all connections, but the leak will likely resume after a while.


The Unanswered Questions:


I can see my en3 inet6 is fe80::A:B, what is en3, I can not do `tcpdump -i en3`.

the socket is from fe80:4:A:B, not fe80:A:B, but it seems the same address, why?

What the is PowerChime doing?


That is the netstat -rn


fe80::A:B%en3 X UHLI lo0

fe80::A:C%en3 X UHLWIi en3


The lsof result like this


PowerChim 8797 myaccount 6u IPv6 0x18af71872161233 0t0 TCP [fe80:4::A:B]:53258->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 7u IPv6 0x997e759c740f3cc 0t0 TCP [fe80:4::A:B]:53262->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 8u IPv6 0xa154905ac25e0f3 0t0 TCP [fe80:4::A:B]:53265->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 9u IPv6 0xdf10ece8d4ff1c4e 0t0 TCP [fe80:4::A:B]:53268->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 10u IPv6 0xf00d9f3eabf7fa34 0t0 TCP [fe80:4::A:B]:53271->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 11u IPv6 0x4ba561d58a25249a 0t0 TCP [fe80:4::A:B]:53274->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 12u IPv6 0x19668884d2cb62cf 0t0 TCP [fe80:4::A:B]:53277->[fe80:4::A:C]:49155 (ESTABLISHED)

PowerChim 8797 myaccount 13u IPv6 0xe730cd1bc3e2085b 0t0 TCP [fe80:4::A:B]:53280->[fe80:4::A:C]:49155 (ESTABLISHED)

...... many many of it


MacBook Air 13″, macOS 14.8

Posted on Dec 16, 2025 8:25 PM

Reply
1 reply

Dec 18, 2025 2:54 AM in response to henry4200

You need to look elsewhere for the " strange and persistent network issue "


On macOS 14 (Sonoma),


/System/Library/CoreServices/PowerChime.app is a built-in system app from Apple.


PowerChime.app is responsible for playing the startup/charging chime sound on Macs:


The sound you hear when:

1 - You plug in a MagSafe or power adapter

2 - (On some models/settings) when the Mac boots

3 - It’s mainly noticeable on MacBooks, especially with MagSafe.


It is an Apple-supplied system component

A - Lives in the  sealed and read-only volume that can’t be opened by users or third-party applications

B - Not malware

C - Should not be deleted or modified

D - Runs only when needed (does not consume resources constantly)


System Settings


1 - System Settings → Sound

2 - Turn off:

3 - “Play sound on startup” (if present on your Mac)


PowerChime.app Leaking 100+ ESTABLISHED IPv6 TCP Connections to Remote Link-Local Address

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.