with netstat -rn in terminal there is this link#18 fe80::%en6/64 link#18 UCI en6 studio_display_adapter_ipv6_here%en6 studio_display_adapter_mac address UHLI lo0 another_ipv6%en6 another_adapter_mac address UHLWIi en6

show's me that the proto is tcp6, the ipv6 address of the studio display ethernet adapter, the en6 interface and the 49000+ port number the pid: 310 and name: /usr/libexec/remoted seems that is listening on this port, I don't know what it is. I've disabled Siri, Handoff and AirPlay but the connection is still active

There are high port numbers 49000+ and it has something to do with /usr/libexec/remoted netstat -Watnlv | grep LISTEN | awk '{"ps -o comm= -p " $9 | getline procname;colred="\033[01;31m";colclr="\033[0m"; print cred "proto: " colclr $1 colred " | addr.port: " colclr $4 colred " | pid: " colclr $9 colred " | name: " colclr procname; }' | column -t -s "|"

well, I use software to capture the packages on that interface, and it’s a quick answer/response over TCP between the to devices about 100 000 packages a day, 74 and 86 bytes long, but for now I don’t know how to read the information in the packages. looks like the other device is on the same network or it inside the Mac mini because just the last four digits of the IPV6 are different in both ipv6, and it’s sending and recovering packages even if the Ethernet and wifi adapter are disabled.

Using ifconfig in terminal I didn’t find any interface with the MAC address specified in the sent packet to the destination I have just the Ethernet adapter of the Studio display. I don’t know how to find the name of the process, the PID or the file that launch this process.