Does accessing ARP table via sysctl trigger Local Network Access prompt?

Starting with macOS 15 (Sequoia), applications that perform network discovery operations now trigger a permission prompt: "Allow [AppName] to find devices on local networks".

I am using sysctl() with NET_RT_FLAGS and RTF_LLINFO to access the ARP table and retrieve gateway MAC addresses:

int mib[6];
mib[0] = CTL_NET;
mib[1] = PF_ROUTE;
mib[2] = 0;
mib[3] = AF_INET;
mib[4] = NET_RT_FLAGS;
mib[5] = RTF_LLINFO; // This flag accesses ARP table entries

if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) 
    return nil;

From my testing, the Local Network Access prompt does not always appear. It looks like if the MAC address is already cached in the ARP table, no prompt is shown, and the prompt only appears when the system needs to resolve a new MAC address.

Is this correct behavior?

Does ARP resolution by itself triggering the prompt?

Answered by DTS Engineer in 857913022

The answer here is… well… fuzzy. I’m gonna recommend that you file a bug about the weird behaviour you’re seeing, so we can use that to investigate further.

IMPORTANT Make sure to include information about why you’re accessing ARP, that is, what high-level goal you’re trying to achieve this way.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

The answer here is… well… fuzzy. I’m gonna recommend that you file a bug about the weird behaviour you’re seeing, so we can use that to investigate further.

IMPORTANT Make sure to include information about why you’re accessing ARP, that is, what high-level goal you’re trying to achieve this way.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Does accessing ARP table via sysctl trigger Local Network Access prompt?
 
 
Q