MacOS – Firewall window pops up then vanishes

dialogfirewallmacbook promacos

For about the last month, I've had the Firewall Accept/Deny incoming connection window pop up at semi-regular intervals. I have not, however, been able to identify the cause. Taking a look at the System Console report shows nothing enlightening. Taking a look at /var/etc/appfirewall.log shows lots of these, though I'm not yet sure if they correlate to the Firewall request message:

<Info>: Stealth Mode connection attempt to UDP 192.168.1.139:61264 from 192.168.1.1:53

Other answers on the site don't seem to be relevant to me: one identifies Facebook Video Calling as the problem, but I don't have Facebook Video Calling installed. (Nor would I!)

I've just tried disabling Stealth Mode in the hopes that it may resolve the issue. In the meantime, however, a few questions:

  1. Is it possible that the Stealth Mode issue is what I'm seeing?
  2. If not, is there anything I can do to capture the screen at relatively low resolution continuously for a while so I can just pick up exactly what the application is?
  3. Why in the world would the firewall dialog go away? Is this what happens if the requesting application stops requesting access, or is something else going on?

Update

The number and frequency of the popups seems to have diminished significantly after disabling Stealth Mode, and I'm no longer seeing that particular set of messages (none today at all, in fact). Now, however, I'm seeing another message (that was appearing before as well, but with much less frequency):

<Info>: java is listening from :::0 proto=6

Some answers to similar questions have suggested simply allowing Java through the firewall. This is, in my mind, more than a little bit crazy; I have Java on my system because I have to, but it is a major security hole these days and I have no interest in letting it have unrestricted access to the internet. Is there a better way of handling this than just opening it up wide open?

See also:

Best Answer

I don't recommend Stealth Mode for this reason, constant pop-ups.

Mac Help says:

If you don’t either allow or deny access, the message remains displayed, and any attempts to connect to the app are denied.

But in my experience, they dismiss instantly.

Unless you want to manage the firewall with one of the third-party apps--which are certainly available—Apple in their wisdom hath now given us an application firewall, and that's what we've got.

Related Question