Unauthorized AirPlay devices
On my MBP (Yosemite), I sometimes see unknown AirPlay output devices available under System / Sound / Output:
I only own one AirPlay device, "John's AirPort Express" – I would never name a device "the best of times". How can I identify these devices - or at least block them? See details before you answer.
My concerns:
- Possible unauthorized traffic on my network.
- Possible virus on my network.
- No good information on diagnosing AirPlay traffic or the AirPlay protocol in general.
Interesting details:
- I even see these devices soon after changing WiFI key.
- Wireless is turned off on my Airport Express (wired).
- My laptop and iPhone are the only devices that use WiFi on my network.
- I also see an unknown ARP records on my laptop soon after clearing ARP cache - see below
- I cannot actually connect to any of these devices.
Unknown ARP records:
$ arp -a
? (192.168.1.11) at (incomplete) on en0 ifscope [ethernet]
? (192.168.1.66) at (incomplete) on en0 ifscope [ethernet]
[snip]
The 192.168.1.11 and .66 addresses appear soon after clearing my laptop's ARP cache - they aren't used by any of my known network devices. Wireshark captures no packets to/from these IP's when listening to en0 in promiscuous mode.
MacBook Pro with Retina display, OS X Yosemite (10.10.5), null