为什么 macOS 的 syslogd 正在监听 UDP 连接？

发布于 4 月 8 日

April 7 2025 Event: Little Snitch alerted of an incoming connection attempt from IPv4 142.250.191.99 to UDP port 56878 (denied). IP is in a Google-controlled range.
- Little Snitch Network Monitor showed no previous connections to syslogd process in the last month and no previous incoming connections from that IP. But there were outgoing connections to it, like an outgoing UDP QUIC connection from Safari to fonts.gstatic.com on port 443 at the same time.
- syslogd is the Apple System Log server at /usr/sbin/syslogd. Its man page says it should not listen for UDP connections by default but it was. The port 56878 seems randomly selected and was different on different macOS volumes.
- Theory: Outgoing QUIC connection randomly selected the same local UDP port as syslogd, causing Google to attempt to connect to syslogd by chance.
Addendum: Realized syslogd UDP listener was present on macOS 12 Monterey and also appeared on Big Sur after booting into different versions. syslogd doesn't always listen on a UDP port, e.g., not on current MacBook Pro. Unsure when and why it starts and stops listening.
Author and Links: By Jeff Johnson (https://lapcatsoftware.com/), with links to his apps (https://underpassapp.com/, https://www.paypal.me/JeffJoh..., Mastodon (https://mastodon.social/@lapc... "@mailto:lapcatsoftware@mastodo...l") and articles index (https://lapcatsoftware.com/ar... "The Desolation of Blog"). Previous article was NSURLComponents changed in macOS 15.4.

阅读 36