Excessive background IPv6 traffic on Apple Silicon Mac triggering ISP data overages and Safari breaks with LuLu Firewall workaround

Hi all,

I wanted to document an issue I recently diagnosed and partially mitigated on my Apple Silicon MacBook Air (M4, March 2025) running the macOS 15.3.2.

After setting up the new Mac, my ISP (Xfinity) reported I exceeded my 1.2 TB monthly data limit within just a few days, despite Activity Monitor showing less than a few dozen GB of usage.

I had never had this problem before, and had been previously using an older Macbook Pro 2013 model. I had not changed my internet usage habits or computer use when migrating to my new Macbook Air, and had essentially migrated to the new machine using Time Machine. Specifically, there was no significant streaming, downloading, or iCloud syncing (I don't use this) on my new computer.

Note: this "phantom" data was not visible through any built-in monitoring tools (e.g. Activity Monitor, Stats). However, I confirmed with my ISP that this spike in network usage (> 100x over baseline) had started the day that I purchased and started using my Macbook Air on my home network.

Here is what i found using nettop and the LuLu firewall:

• The system process com.apple.WebKit.Networking.xpc (used by Safari and other Apple apps) was opening persistent connections over IPv6, even when Safari was not in use.
• These connections often resolved to Google (*.1e100.net), Cloudflare, or AWS endpoints.
• Even after setting “Configure IPv6: Link-local only”, macOS continued allowing these background IPv6 connections.
• Other processes like parsecd, cloudd, and nsurlsessiond were also active, but I did not block those, only WebKit.

The fix (partial):

1. Installed LuLu firewall
2. Unchecked “Allow Apple programs” in LuLu settings
3. Blocked com.apple.WebKit.Networking.xpc
4. Confirmed using nettop that IPv6 connections from WebKit were gone
5. Re-enabled IPv6 system-wide

After blocking WebKit.Networking.xpc, Safari can no longer load any websites -- it effectively breaks, since that process handles all network requests.

So this fix:

• Stops invisible IPv6 traffic from WebKit, though at the cost of losing Safari functionality
• Other background Apple daemons (like parsecd, cloudd) are still active and occasionally use IPv6. I am letting them run for now.

In summary:

• macOS system daemons can silently initiate high-volume, "phantom" IPv6 traffic that is invisible to the user
• Activity Monitor and Safari show nothing, but your ISP may still count it
• This can lead to data overage charges (in my case, over $100 in my first month as I blew past the data usage limits in just a few days)

Feature Requests:

• There should be a native way to monitor per-process data usage, including IPv6
• Apple should notify users when background services generate sustained traffic
• System Settings > IPv6 should fully disable IPv6, not just hide it

Would love to hear if others have seen similar unexplained data usage on newer Macs running Apple Silicon.

[Re-Titled by Moderator]