JOHANNES Ullrich of the SANS Internet Storm Centre has examined the network activity generated by macOS 27 “Golden Gate” before a user logs in. In a brief capture, he recorded about 300 packets, although the total was probably increased because the test system used both Wi-Fi and wired interfaces, each of which performed its own DHCP and IP discovery. IPv6 duplicate-address detection worked as expected and used ICMPv6 nonces, which help prevent some spoofing-based denial-of-service attacks. The system also advertised no services through multicast DNS on UDP port 5353.
The boot process generated DNS look-ups for Apple and network-related domains, including `_dns.resolver.arpa`, Apple push-messaging hosts, `albert.apple.com` for device activation, `appleid.apple.com`, `ipv4only.arpa` for NAT64 discovery and `www.apple.com` for captive-portal detection. Ullrich advises not blocking `albert.apple.com`, noting that it uses certificate pinning and should not be subjected to TLS interception.
Four TCP connections were observed: HTTPS to `albert.apple.com`, an IPv6 OCSP request to `ocsp.digicert.com` to validate that certificate, and encrypted connections to Apple push services on ports 443 and 5223. The captured OCSP request used the user agent `com.apple.trustd/3.0`. Safari identified itself as version 27.0, while reporting the platform as “Intel Mac OS X 10_15_7”, despite the test machine using an Apple M-series processor.