Threat Level: green Handler on Duty: Renato Marinho

SANS ISC: Apple Lion talking on TCP 5223 - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Apple Lion talking on TCP 5223

When Lion first appeared in the Apple App store most of probably blindly click YES YES YES like good little Apple zombies (me included!)... After some updates and fiddling with Applications to get them working I started to take a hard look at what was now leaving my devices. A new series of packets on port TCP 5223 was leaving outbound from my network stack and thanks to Little Snitch [1] I was in control of it.

On Apple's support site [2] You will find a list of well know TCP/UDP ports used by Apple operating systems and according to their site:

5223 TCP XMPP over SSL, Apple Push Notification Service -   MobileMe (Automatic sync notifications) (see note 9), APNs, FaceTime, Game Center

 

Check out my first Video Diary of taking a look at these packets.

 

Richard Porter

--- ISC Handler on Duty

 

[1] http://www.obdev.at/products/littlesnitch/index.html

[2] http://support.apple.com/kb/ts1629

Richard

160 Posts
ISC Handler
Take a look at http://isc.sans.org/port.html?port=5223 and you will see a big jump. Also, this page identifies it as jabber im service over ssl. So do we have apple renaming the service, or do we have 2 different protocols over the same port?
Moriah

133 Posts Posts
XMPP was born of Jabber -- see RFC3920 http://xmpp.org/rfcs/rfc3920.html
Paul

44 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!