Private relay is sending lots of data to mask.icloud

[schnitzel-pretzel]

Wondering if anyone else here is using Private Relay and also has Little Snitch or some sort of network monitor installed. I noticed today that Private Relay has been sending almost as much data as I download, which is super sketchy. As in, if I load a Google Images page with 3MB of data, Little Snitch also shows ~3MB of upload data.

This is not replicable with any other browser, or with Private Relay turned off. I think it's incredibly suspect -- what plausible explanation is there for this?

 

[Apple_Robert]

There is nothing sketchy going on.

https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF

 

[schnitzel-pretzel]

I am not sure what you're pointing to in that document that would explain this. The request goes to a relay, instead of going straight to the web server you requested from. And then you download the result from the relay.

Here are two screenshots of Little Snitch network monitoring -- one downloading the file with Chrome, one with Safari.

Screenshot-2024-04-26-at-7-44-22-PM hosted at ImgBB

Image Screenshot-2024-04-26-at-7-44-22-PM hosted in ImgBB

ibb.co

Screenshot-2024-04-26-at-7-43-18-PM hosted at ImgBB

Image Screenshot-2024-04-26-at-7-43-18-PM hosted in ImgBB

ibb.co

Guess which is which?

The Chrome download pulled down 15MB and uploaded nothing.

The Safari download pulled won 15MB and uploaded 5MB!!!

Explain this...

 

[schnitzel-pretzel]

Update:

I'm starting to think it's something wrong with Little Snitch. Either that, or some really messed up spying is happening, where Apple would have to be hiding it from their own network monitor.

I tracked a download from Safari with Private Relay turned on, using both Little Snitch and Activity Monitor, and here are the results:

Screenshot-2024-04-26-at-8-07-19-PM hosted at ImgBB

Image Screenshot-2024-04-26-at-8-07-19-PM hosted in ImgBB

ibb.co

Screenshot-2024-04-26-at-8-07-32-PM hosted at ImgBB

Image Screenshot-2024-04-26-at-8-07-32-PM hosted in ImgBB

ibb.co

So the Activity Monitor is showing only download, no upload. Little Snitch, on the other hand, is showing lots of uploading.

I suspect Little Snitch is getting screwed up by Private Relay, I'm still just not sure how. I'll definitely be contacting them, because that's an expensive little App and it should do it's job.

Is there anything else I can do here networking wise to figure out if this traffic is real?

 

[gilby101]

I'm starting to think it's something wrong with Little Snitch. Either that, or some really messed up spying is happening, where Apple would have to be hiding it from their own network monitor.

The complexities of networking on your Mac are such that LS may not be seeing exactly what you expect. Almost certainly not spying by this parties.

Apple (like commercial VPN software) intercepts network connections and packets using a range of methods. This can confuse LS (and others). Run ifconfig in terminal to see a list of all network interfaces - you my be horrified (but don't worry).

And Activity Monitor is, presumably, aware of what macOS is doing with Private Relay and so only shows what Activity Monitor thinks is relevant to you.

If you really want to know what is going on, you need to use Wireshark (or similar) to collect packets from specific network interfaces. I don't suggest you do unless you seriously want to explore networking.

 

[schnitzel-pretzel]

The way I see it, the only thing left to do to verify that Little Snitch is lying and Activity Monitor is telling the truth, is to check traffic at my router level. I don't even need to see specifics, just total bytes sent and received over some amount of time. I can download a large file on Safari, and it should fairly quickly be obvious if traffic is going out at a high rate

 

[CuteBaby]

The way I see it, the only thing left to do to verify that Little Snitch is lying and Activity Monitor is telling the truth, is to check traffic at my router level. I don't even need to see specifics, just total bytes sent and received over some amount of time. I can download a large file on Safari, and it should fairly quickly be obvious if traffic is going out at a high rate

How did it go?