Numerous ATV DAAP ports to MacBook Pro

Question

This is related to Apple TV3, sorry for the long intro.My internet connectivity pretty much *****.Speed Tests show I&#x27;m receiving 16M download as advertised.When I try to connect to a web page, it often freezes and only partially downloadsUsing "netstat" or "network utility" I often find a number of TCP connections in SYN_SENT stateAnd when I say "a number" as many as 111 connections with maybe 1/3 of them in SYN_SENT.While this hardly seems like a lot, it leads me to question why so many, which in turn leads me tofind these connections between my MacBook Pro (Mavericks) and Apple TV 3.  Why so many?I do NOT have Home Sharing turned on for iTunes on my Laptop, yet it shows up as one of thelibraries available to the ATV3.  And I can play the TV shows available on the laptop throughthe ATV3.  The ATV3 is connected via ethernet to an Airport Express. (As an aside, the mini-mac (2009 model running Mavericks) which is the iTunes Library (12.1) i want to share will often require me to reboot the ATV3 if it hasn&#x27;t been accessed for more than 12 hours)Although it should not matter, I wonder if the UBEE cable modem router (which isproviding DHCP) is seeing these connections and is hitting some limit on port forwardingwhich is (part of) the cause of my lousy internet service.Anyway, why so many ESTABLISHED connectionsand why do only some of these listed connections include the system name(they are all between the same ATV3 and MBP)tcp4       0      0  192.168.0.8.daap       192.168.0.254.54603    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54596    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54595    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54594    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54593    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54592    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54548    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54544    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54523    ESTABLISHEDtcp4       0      0  192.168.0.8.daap       192.168.0.254.54517    ESTABLISHEDtcp6       0      0  johns-macbook-pr.daap  great-room-apple.54507 ESTABLISHEDtcp6       0      0  johns-macbook-pr.daap  great-room-apple.54504 ESTABLISHED

John Zwiebel · Answer

While trying to install wireshark, and because my Ubee cable modem is pretty much useless.  Some of the above information has changed.FWIW: I was able to reconfigure the Ubee to "bridge mode" so that NAT/DHCP would be handled by the Airport Express.While doing this I rebooted my laptop (something I&#x27;ve done before without affecting whether or not home sharing was available through the AppleTV)Anyway, this time the AppleTV no longer shows my laptop as available through home sharing.  (It should never have been)Note that my laptop still shows open DAAP ports.  What is "interesting" now is that 10.0.1.9 is -AN- address of the airport expresstcp4       0      0  10.0.1.4.daap          10.0.1.9.49266         ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49265         ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49264         ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49258         ESTABLISHEDNOTE the HW address here is all the same.  This is the MAC address of the Aiport Express on its e0 interfaceNOTE 10.0.1.1 is the default route, why it is connected to the e0 interface (vs the wireless interface) is kind of confusing)apt-express e0 (10.0.1.1) at 90:72:40:0c:8c:9f  on en1 ifscope [ethernet]Apple e0       (10.0.1.9)    90:72:40:0c:8c:9f on en1 ifscope [ethernet]Apple e0       (10.0.1.13)   90:72:40:0c:8c:9f on en1 ifscope [ethernet]I guess the question is: "Why does an Airport Express give itself additional IP addresses on the wireless interface through DHCP?"Is someone spying on me?

John Zwiebel · Answer

I have confirmed...DAAP sockets are opened in "Listen State" when iTunes is started.If iTunes is not open there are no DAAP packets seen on the laptop (using TCPDUMP)When iTunes is opened on the Laptop my Airport Extreme will send DAAP packets to my laptop.This can take some time.  Note there are both IPv6 and IPv4 packets sent, but no IPv6 sockets are opened.These two packets are only representative of the packets received.    There were 140 packets sent within 1 second.10:02:17.021059 IP 10.0.1.23.53344 &gt; 10.0.1.4.daap: Flags [S], seq 2688013582, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 1065574933 ecr 0,sackOK,eol], length 010:02:17.225405 IP6 great-room-apple-tv.local.53345 &gt; johns-macbook-pro.local.daap: Flags [S], seq 2017228350, win 65535, options [mss 1440,nop,wscale 4,nop,nop,TS val 1065575136 ecr 0,sackOK,eol], length 0This will open several DAAP sockets on the laptop.tcp4       0      0  10.0.1.4.daap          10.0.1.23.53372        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.23.53371        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.23.53370        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.23.53369        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.23.53368        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.23.53358        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.23.53353        ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49314         ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49313         ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49312         ESTABLISHEDtcp4       0      0  10.0.1.4.daap          10.0.1.9.49308         ESTABLISHED10.0.1.4    Laptop10.0.1.9    Airport Extreme10.0.1.23  Airport ExtremeNOTE the hardware address.  This is the MAC address of the AEX that is plugged into the cable modem.10.0.1.1 is the default route to the Internet.? (10.0.1.1) at 90:72:40:c:8c:9f on en1 ifscope [ethernet]? (10.0.1.9) at 90:72:40:c:8c:9f on en1 ifscope [ethernet]? (10.0.1.22) at 90:72:40:c:8c:9f on en1 ifscope [ethernet]? (10.0.1.23) at 90:72:40:c:8c:9f on en1 ifscope [ethernet]

John Zwiebel · Answer

NOTE: the longer I leave iTunes run, the more sockets are opened.4 more sockets are opened approximately every minute

John Zwiebel · Answer

NOTE: ipv6 sockets will also be open, but only 4 of them and these go only to the AppleTV.The AppleTV does not show up in the ARP tabletcp6       0      0  johns-macbook-pr.daap  great-room-apple.54393 ESTABLISHEDtcp6       0      0  johns-macbook-pr.daap  great-room-apple.54392 ESTABLISHEDtcp6       0      0  johns-macbook-pr.daap  great-room-apple.54391 ESTABLISHEDtcp6       0      0  johns-macbook-pr.daap  great-room-apple.54390 ESTABLISHEDndp -aNeighbor                        Linklayer Address  Netif Expire    St Flgs Prbslocalhost                       (incomplete)         lo0 permanent R      z-mini-2.local                  0:26:b0:e9:c5:14     en1 16s       R      great-room-apple-tv.local       68:d9:3c:7d:a2:3f    en1 39s       R               &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt; This MAC address is not in the ARP table.johns-macbook-pro.local         70:56:81:93:c7:c9    en1 permanent R      puu-base.local                  90:72:40:c:8c:9f     en1 23h20m46s S  R

John Zwiebel · Answer

To replicate the problem and provide some packet exchanges...I have iTunes running on my laptop.I wake up my ATV and navigate to the "computers" menu.The ATV claims that there is no Homesharing turned on on any computers.     -- There is a minimac with iTunes running and HomeSharing on   -- My laptop has iTunes running with HomeSharing OffThe ATV is restarted, when I navigate the the "computers menu"    -- both the mini-mac and the laptop show as options on the ATV.  (The laptop should not be there)   -- 3 DAAP sockets are opened on my laptop using IPv4I ignore the ATV for about an hour waiting for it to go to sleep.  (meaning there is no output to the TV HDMI)  -- DAAP sockets start getting open on my laptop and not closed  -- Both IPv6 and IPv4 sockets are being opened  -- There are "huge bursts" of DAAP packet exchanges (using tcpdump) between the laptop and the ATV.  (over 200 packets per "burst")  -- Between 12:29 and 12:53 there were 12 Bursts capturing a total of 1175 DAAP packets  -- there are now 34 daap sockets open, they are both IPv4 and IPv6 sockets.  -- nap shows 17 IPv6 addresses associated with the MAC address of the ATV for example:     2605:e000:1103:8102:c15e:ece6:8835:4627 68:d9:3c:7d:a2:3f en1 23h51m56s S           2605:e000:1103:8102:cc7c:6364:4898:4a64 68:d9:3c:7d:a2:3f en1 23h35m13s S        -- arp -a shows the ATV address associated with the MAC address of the Apple Airport Extreme (tower)     ? (10.0.1.21) at 90:72:40:c:8c:9f on en1 ifscope [ethernet]  -- tcpdump shows DAAP packets being exchanged to the MAC address of both the AEX and the ATV.  (I only tracked DAAP packets)  -- Some bursts are initiated by the ATV  -- Some bursts are initiated by the laptop      --- bursts initiated by the laptop are sometimes sent to the ATV MAC address and sometimes to the AEC MAC           bursts that start out being sent to the AEC MAC will end transition to the ATV MACIf someone wants to review the tcpdump of the packet bursts, I&#x27;ll be happy to share the file via some other method than posting it here.When I wake up the ATV, some DAAP sockets time out.  Although it takes a while.The Bursts of packets have stopped but there is still an exchange of packets.  These exchanges are both IPv6 and IPv4 and appear to be initiated by the laptop. I&#x27;m guessing they are closing the sockets.   However, many of the sockets remain openor in CLOSE_WAIT state and there haven&#x27;t been any packets exchanged for the last 30 minutes14:25:36.648586 70:56:81:93:c7:c9 (oui Unknown) &gt; 68:d9:3c:7d:a2:3f (oui Unknown), ethertype IPv6 (0x86dd), length 86: johns-macbook-pro.local.daap &gt; great-room-apple-tv.local.49232: Flags [F.], seq 3866625054, ack 343499458, win 8192, options [nop,nop,TS val 478909895 ecr 156581444], length 0  0x0000:  600a 2225 0020 0640 fe80 0000 0000 0000  &#x60;."%...@........  0x0010:  7256 81ff fe93 c7c9 fe80 0000 0000 0000  rV..............  0x0020:  0877 0d72 a14b 4794 0e69 c050 e678 041e  .w.r.KG..i.P.x..  0x0030:  1479 62c2 8011 2000 75c6 0000 0101 080a  .yb.....u.......  0x0040:  1c8b 95c7 0955 3e44                      .....U&gt;D14:25:36.651504 68:d9:3c:7d:a2:3f (oui Unknown) &gt; 70:56:81:93:c7:c9 (oui Unknown), ethertype IPv6 (0x86dd), length 74: great-room-apple-tv.local.49232 &gt; johns-macbook-pro.local.daap: Flags [R], seq 343499458, win 0, length 0  0x0000:  600a 2225 0014 0640 fe80 0000 0000 0000  &#x60;."%...@........  0x0010:  0877 0d72 a14b 4794 fe80 0000 0000 0000  .w.r.KG.........  0x0020:  7256 81ff fe93 c7c9 c050 0e69 1479 62c2  rV.......P.i.yb.  0x0030:  0000 0000 5004 0000 b36d 0000            ....P....m..Kind of off-topic, and perhaps should be on a separate thread...This show that two IP addresses have been assigned to the ATV.  The first is the wireless (I assume) MAC on the ATV.The second shows the ethernet interface on the ATV.  The ATV is connected via ethernet.  The ATV is connected via ethernet.It knows about the wireless network, but I don&#x27;t think it should be using it.? (10.0.1.19) at 68:d9:3c:7d:a2:3e on en1 ifscope [ethernet]? (10.0.1.21) at 68:d9:3c:7d:a2:3f on en1 ifscope [ethernet]

John Zwiebel · Answer

When iTunes was shut down on the laptop, it tried to close the remaining open daap ports.It was sending these messages to the MAC address of the Apple Airport Extreme, using the last IP address of the AppleTV.Of course, the AEX did not respond to these packets.Finally, all the daap ports (which had reached a high of 64) timed out and closed down.17:06:52.780430 70:56:81:93:c7:c9 (oui Unknown) &gt; 90:72:40:0c:8c:9f (oui Unknown), ethertype IPv4 (0x0800), length 289: 10.0.1.4.daap &gt; 10.0.1.21.49260: Flags [FP.], seq 0:223, ack 1, win 8202, options [nop,nop,TS val 488358309 ecr 1021014170], length 223  0x0000:  4500 0113 1927 4000 0206 48a6 0a00 0104  E....&#x27;@...H.....  0x0010:  0a00 0115 0e69 c06c f58b 374a 77fc ef41  .....i.l..7Jw..A  0x0020:  8019 200a 9e2a 0000 0101 080a 1d1b c1a5  .....*..........  0x0030:  3cdb 709a 4854 5450 2f31 2e31 2032 3030  &lt;.p.HTTP/1.1.200  0x0040:  204f 4b0d 0a44 6174 653a 2057 6564 2c20  .OK..Date:.Wed,.  0x0050:  3138 2046 6562 2032 3031 3520 3033 3a30  18.Feb.2015.03:0  0x0060:  363a 3034 2047 4d54 0d0a 4441 4150 2d53  6:04.GMT..DAAP-S  0x0070:  6572 7665 723a 2069 5475 6e65 732f 3132  erver:.iTunes/12  0x0080:  2e31 2e30 2e35 3020 284f 5320 5829 0d0a  .1.0.50.(OS.X)..  0x0090:  436f 6e74 656e 742d 5479 7065 3a20 6170  Content-Type:.ap  0x00a0:  706c 6963 6174 696f 6e2f 782d 646d 6170  plication/x-dmap  0x00b0:  2d74 6167 6765 640d 0a43 6f6e 7465 6e74  -tagged..Content  0x00c0:  2d4c 656e 6774 683a 2034 340d 0a43 6f6e  -Length:.44..Con  0x00d0:  7465 6e74 2d45 6e63 6f64 696e 673a 2067  tent-Encoding:.g  0x00e0:  7a69 700d 0a0d 0a1f 8b08 0000 0000 0000  zip.............  0x00f0:  ffcb 2d2d 4861 6060 90c8 2d2e 2901 d22c  ..--Ha&#x60;&#x60;..-.)..,  0x0100:  407c 22b7 b4b8 08ca 6600 0058 633d c820  @|".....f..Xc&#x3D;..  0x0110:  0000 00                                  ...