Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

What the heck is the Apple TV doing all the time on the network when in sleep mode?

zorinlynx

zorinlynx

macrumors G3
Original poster
May 31, 2007
8,362
18,652
Florida, USA
This is a graph of the network usage of my Apple TV 4K for the past 32 hours or so. It was asleep the entire time except for around 20:00 last night when I watched some TV. Blue is downloads from the Internet, green is uploads.

The ENTIRE time it's asleep, except for short breaks here and there, it's hitting the Internet downloading data. It's not a lot of data, maybe an average of 60K/sec or so, but it's still up to something and I'm curious what. Has anyone else seen this and discovered what it is? I've turned off the Homekit hub, thinking it might be that, but it still does it. My next step will be to sign it out of iCloud, but before I take that big step I want to know if anyone else has dealt with this and fixed it. Screen Shot 2022-06-07 at 6-7, 12.06.43 PM.png
 
Are you sure that's internet data and not perhaps just sync checks with the home share computer? Why don't you give the modem a break one night so you have no Internet while you sleep and see if this activity is actually within the home network.

I think- but don't know for sure- AppleTV has some basic multitasking. Any open apps in the background that might pull a bit of data like that regularly? Weather app? Sports score app? Stock portfolio app? TV streamer updating guide?

Those peaks are so consistent, I'm strongly doubting anything nefarious. My wild guess is it is regularly checking the home share computer to see if there is any new music, any new video, etc. Or grabbing a chunk of (external) data over and over to keep something like some of those Weather/sports/stock/news/TV apps up to date?

If you give the modem a night off one night, you could at least better pin down is it outside data or maybe inside data.
 
HobeSoundDarryl said:
Are you sure that's internet data and not perhaps just sync checks with the home share computer? Why don't you give the modem a break one night so you have no Internet while you sleep and see if this activity is actually within the home network.

I think- but don't know for sure- AppleTV has some basic multitasking. Any open apps in the background that might pull a bit of data like that regularly? Weather app? Sports score app? Stock portfolio app? TV streamer updating guide?

Those peaks are so consistent, I'm strongly doubting anything nefarious. My wild guess is it is regularly checking the home share computer to see if there is any new music, any new video, etc. Or grabbing a chunk of (external) data over and over to keep something like some of those Weather/sports/stock/news/TV apps up to date?

If you give the modem a night off one night, you could at least better pin down is it outside data or maybe inside data.
Click to expand...
It's absolutely talking to the Internet, those same spikes are on the router's WAN interface (in the other direction of course).

The amount of data being used isn't even enough to cause a problem, it just clutters up my graphs and makes me wonder what it could be up to. I actually have two Apple TVs, an HD in another room that I rarely use, and this one. Both of them were doing it, the HD on the Wifi interface and this one on that port (cabled). So it's not specific to this Apple TV, it's a general thing tvOS is doing. I even unplugged the other one since I use it about once a month; why have it farting around on the network if it doesn't need to be.
 
Then I’m back to some app regularly grabbing a bit of info updating data like a weather app pulling new weather details or a news app grabbing new news feeds, sports scores, stock prices for stocks you put in a portfolio, icloud checks for new anything’s relevant to AppleTV that might change or update by other Apple devices, etc.

Since the spikes are so consistent and seemingly a fixed amount of data, I suspect something that would look like that… for example updated prices on the 12 stocks someone has in a portfolio app, or the weather basics for YourTown, YourState. I’m shakier on sports scores because the volume of games played vary each day and news seems likely to vary headline volume based on bigger news days vs lesser ones.

If I wanted to try to deduce this out, I’d probably carefully think through each installed app and imagine their data needs. For those that seem like they would need a pretty regular dose of same-size updates, I might alter whatever I have them doing one by one and then checking those spikes again. For example, if I do track 12 stocks in a portfolio, that probably grabs the same basic data for those stocks over and over. To test if it is the cause, maybe add 12 more stocks for a night and see if those data usage spikes double.

With 2 AppleTVs doing the same, you can rule out unique apps on each and focus in on only the same ones installed on both.

Perhaps try factory restoring one of them to narrow it down to Apple default apps? Or rule out background apps altogether and assume this into tvOS itself? Maybe that’s what “checking for tvOS software updates” looks like when set to automatically update? Maybe that’s the frequency of checks when you have “automatically keep apps up to date” turned on? Etc. This could be a game of working through settings and turning off ‘automatically do” things until maybe you find THE one(s) that checks or grabs a little data that frequently.

It seems like too much data to be something simple like synching date & time with a distant server. There is a lot of dependencies on location so maybe it is frequently deducing its current location?

With 2 grabbing the exact same bites of data, I would assume “normal” but with a bunch of step-by-step testing, you might be able to pin it down to a few settings or default apps background processing or something in tvOS wanting to “phone home” frequently. Maybe this is what digital media ratings tracking looks like? Or “anonymously share data with Apple” looks like? Or Siri actively listening for “hey Siri”? Or HomeKit devices checking in with each other? Etc.

If you suspect hacking- and I don’t myself- change your password and see if the spikes persist right after. No hacker is going to be that on top of guessing a new password that quickly… especially on a mostly read-only device that generally doesn’t hold much detail they could put to nefarious or profitable use.
 
Last edited:
  • Like
Reactions: -BigMac-
I suspect the packets are going to be SSL encrypted, but you could always take a packet capture and see where the traffic is going if you're concerned. I would suspect background updates. Apps, Images, Usage Data, etc.
 
Yes, packets are going in & out all the time on the ATV. Apple.com, AppleTV+, Hulu (I don't even have a hulu acct), Netflix, TLS, iTunes, HTTP over TLS. DHCP lease refresh activity is really wild on my older box. It used to bother me. I pestered Apple to no avail.
 
I am not seeing the same thing. I use the Fing app to manage my network, and it has a bandwidth analysis tool that measures upload and download speeds and sizes. When I turned it on for my ATV 4K, it is registering no network activity for the five minues that I have been watching. The ATV is sleeping.
 
zorinlynx said:
This is a graph of the network usage of my Apple TV 4K for the past 32 hours or so. It was asleep the entire time except for around 20:00 last night when I watched some TV. Blue is downloads from the Internet, green is uploads.

The ENTIRE time it's asleep, except for short breaks here and there, it's hitting the Internet downloading data. It's not a lot of data, maybe an average of 60K/sec or so, but it's still up to something and I'm curious what. Has anyone else seen this and discovered what it is? I've turned off the Homekit hub, thinking it might be that, but it still does it. My next step will be to sign it out of iCloud, but before I take that big step I want to know if anyone else has dealt with this and fixed it.View attachment 2015372
Click to expand...
Do you have it set to download new screensaver images periodically -- like if you use that Aerial screensaver in particular? Those are big files and it might be chipping away at updating those?

I also wonder if it could be checking for app updates or something.
 
Your question got me curious, so I pulled the Pi-hole log for my Apple TV. It's been in sleep mode since around 10:30 last night. But over the span of the last 10 minutes, I see it making many requests + most of them seem to be to various apple.com, iCloud.com, akadns.net, akamai.net, and apple-dns.net subdomains.

I agree with the thought above that it could be downloading new screensavers, pre-caching content, etc. based on the DNS queries coming out of it.

The only Apple TV DNS queries my Pi-hole is blocking are to metrics.icloud.com, so it doesn't seem to me it's doing anything untoward. Certainly nothing compared to my Roku devices!
 
Just curious. Our Apple TV is on a power saving strip. When the TV goes off, power to the Apple TV goes off. The only time it goes to sleep is when we are watching cable TV instead of streaming (yeah, we're old!). Any issues with it being powered off most of the time? At least no network traffic :)
 
techmuscle said:
Just curious. Our Apple TV is on a power saving strip. When the TV goes off, power to the Apple TV goes off. The only time it goes to sleep is when we are watching cable TV instead of streaming (yeah, we're old!). Any issues with it being powered off most of the time? At least no network traffic :)
Click to expand...
I'd say no issues with that other than potentially missing automatic updates overnight and slightly longer wait times while it boots. But IMO that's not the biggest deal; just update when prompted / if and when you choose to do so.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back