MacOS – Where did sharingd file find the IP address it trying to connect

macosNetwork

I have this mac app installed LULU (https://objective-see.com/products/lulu.html)
using which I discovered /usr/libexec/sharingd trying to local IP Address 192.168.2.255.
I figured out what sharingd is from here https://discussions.apple.com/thread/6501958

Update: usr/sbin/netbiosd
also tries to access the same ip address.

but I want to know from where does sharingd discovers/find out IP address ?
result of ifconfig without mac address:

$ ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
    inet 127.0.0.1 netmask 0xff000000 
    inet6 ::1 prefixlen 128 
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
    nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
EHC29: flags=0<> mtu 0
EHC26: flags=0<> mtu 0
XHC20: flags=0<> mtu 0
en0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
    media: autoselect (none)
    status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    inet 192.168.5.218 netmask 0xffffff00 broadcast 192.168.5.255
    media: autoselect
    status: active
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
    media: autoselect
    status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
    inet6 fe80::5cc0:dbff:fee3:d8e0%awdl0 prefixlen 64 scopeid 0xa 
    nd6 options=201<PERFORMNUD,DAD>
    media: autoselect
    status: active
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
    options=60<TSO4,TSO6>
    media: autoselect <full-duplex>
    status: inactive
fw0: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 4078
    lladdr 00:3e:e1:ff:fe:49:4e:9e 
    media: autoselect <full-duplex>
    status: inactive
bridge0: flags=8822<BROADCAST,SMART,SIMPLEX,MULTICAST> mtu 1500
    options=63<RXCSUM,TXCSUM,TSO4,TSO6>
    ether d2:00:14:94:e9:e0 
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x2
    member: en2 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 11 priority 0 path cost 0
    media: <unknown type>
    status: inactive
bridge100: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    options=3<RXCSUM,TXCSUM>
    ether 42:6c:8f:15:90:64 
    inet 192.168.2.1 netmask 0xffffff00 broadcast 192.168.2.255
    inet6 fe80::406c:8fff:fe15:9064%bridge100 prefixlen 64 scopeid 0xe 
    Configuration:
        id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
        maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
        root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
        ipfilter disabled flags 0x2
    member: en0 flags=3<LEARNING,DISCOVER>
            ifmaxaddr 0 port 7 priority 0 path cost 0
    nd6 options=201<PERFORMNUD,DAD>
    media: <unknown type>
    status: inactive
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
    inet6 fe80::f21f:cbe5:bae0:c2e1%utun0 prefixlen 64 scopeid 0xf 
    nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
    inet6 fe80::7fa7:7485:c59b:f50%utun1 prefixlen 64 scopeid 0x10 
    nd6 options=201<PERFORMNUD,DAD>
en4: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    inet 169.254.218.132 netmask 0xffff0000 broadcast 169.254.255.255
    media: autoselect (100baseTX <full-duplex>)
    status: active

Best Answer

macOS implements mDNS - Multicast DNS to find other devices on the same network segment. Basically, it says - who can share files and if the other IP answers - you have a connection that can be made if you click on that host in Finder (for one of many possible instances)

It's called Bonjour when it's wrapped up in IPv4/IPv6 as well as bluetooth zero configuration networking and this tech powers things like AirPlay, Printer Sharing, handoff / continuity and more.

So to answer your question, it found it by asking on your network. It's not clear why you have 192.168.5.255 and 192.168.2.255 both as broadcast networks, but that's not necessarily wrong if you have your network set up like that.

Related Question