I have not done this type of diary in a while: What traffic will you see from a system on boot, before a user logs in? I just took a quick look at macOS 27 "Golden Gate" to see what traffic you should expect. Here are some of the highlights:
I captured about 300 packets. This was likely inflated for this particular system as it connected via Wi-Fi and wired network in...