Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Unauthorized AirPlay devices

On my MBP (Yosemite), I sometimes see unknown AirPlay output devices available under System / Sound / Output:

User uploaded file

I only own one AirPlay device, "John's AirPort Express" – I would never name a device "the best of times". How can I identify these devices - or at least block them? See details before you answer.


My concerns:

  1. Possible unauthorized traffic on my network.
  2. Possible virus on my network.
  3. No good information on diagnosing AirPlay traffic or the AirPlay protocol in general.


Interesting details:

  1. I even see these devices soon after changing WiFI key.
  2. Wireless is turned off on my Airport Express (wired).
  3. My laptop and iPhone are the only devices that use WiFi on my network.
  4. I also see an unknown ARP records on my laptop soon after clearing ARP cache - see below
  5. I cannot actually connect to any of these devices.


Unknown ARP records:

$ arp -a

? (192.168.1.11) at (incomplete) on en0 ifscope [ethernet]

? (192.168.1.66) at (incomplete) on en0 ifscope [ethernet]

[snip]


The 192.168.1.11 and .66 addresses appear soon after clearing my laptop's ARP cache - they aren't used by any of my known network devices. Wireshark captures no packets to/from these IP's when listening to en0 in promiscuous mode.

MacBook Pro with Retina display, OS X Yosemite (10.10.5), null

Posted on Oct 24, 2015 10:38 AM

Reply

There are no replies.

Unauthorized AirPlay devices

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.