"icloud-base" excessive hits on firewall

Jason.Hill — Fri, 09 Jun 2017 02:16:11 GMT

Hi there,

I have a question in regards to iCloud (application = icloud-base) and I was hoping someone could shed some light on or point me in the righht direction.

I have a source address which is showing in the URL Logs as blocked due to our restriction on 'online-storage-and-backup'. normally I could see a source IP hitting this about 10,000 per hour if iCloud has not been disabled on the endpoint (OSX Desktop), however I have one user who is hitting this rule around 110,000 times per hour and I can't figure out why.

We've logged out of iCloud on that machine and now the traffic has stopped, but I'd still like to figure out why it was so exxcessive in this case.

The various destinations seem standard such as (but not limited to):

setup.icloud.com

keyvalueservice.icloud.com

p18-ckdatabase.icloud.com

p18-availability.icloud.com

p18-quota.icloud.com

Thanks in advance for your time and help

Re: "icloud-base" excessive hits on firewall

BPry — Fri, 09 Jun 2017 13:19:30 GMT

@Jason.Hill,

Apple recently made some changes to the OS that allows you to sync all of the items on your desktop and document folder through iCloud. Could it be that this is enabled, it might explain why you are seeing that many hits. You could try disabling just that section and see if that lowers it to what you would normally be seeing.

https://www.imore.com/how-save-your-desktop-and-documents-folder-icloud-drive-macos-sierra

topic Re: "icloud-base" excessive hits on firewall in General Topics

"icloud-base" excessive hits on firewall

Re: "icloud-base" excessive hits on firewall