Threat Level: green Handler on Duty: Rick Wanner

SANS ISC: Apple Lion talking on TCP 5223 SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Apple Lion talking on TCP 5223

When Lion first appeared in the Apple App store most of probably blindly click YES YES YES like good little Apple zombies (me included!)... After some updates and fiddling with Applications to get them working I started to take a hard look at what was now leaving my devices. A new series of packets on port TCP 5223 was leaving outbound from my network stack and thanks to Little Snitch [1] I was in control of it.

On Apple's support site [2] You will find a list of well know TCP/UDP ports used by Apple operating systems and according to their site:

5223 TCP XMPP over SSL, Apple Push Notification Service -   MobileMe (Automatic sync notifications) (see note 9), APNs, FaceTime, Game Center


Check out my first Video Diary of taking a look at these packets.


Richard Porter

--- ISC Handler on Duty





168 Posts
ISC Handler
Jul 29th 2011
Take a look at and you will see a big jump. Also, this page identifies it as jabber im service over ssl. So do we have apple renaming the service, or do we have 2 different protocols over the same port?

133 Posts
XMPP was born of Jabber -- see RFC3920

44 Posts

Sign Up for Free or Log In to start participating in the conversation!