Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to send all of my unencrypted day-to-day traffic over an SSH tunnel, which is working pretty well with a simple SOCKS proxy. Skype still goes outside, but that's okay, as Skype is encrypted, and I have a few exceptions for sites that refuse service to my choice of SSH endpoint provider (Amazon). Great.

The problem: A lot of DNS requests are still coming through when I watch on tcpdump. Certainly not all of them, but a lot of them. How can I correlate DNS requests to the application making the requests in OS X?

share|improve this question
up vote 0 down vote accepted

Little Snitch won't help that much if the request is satisfied by OS X's high level mechanism (instead of using the resolver library directly). Hands Off might work better as it is intercepting these calls, too (or so it seems).

share|improve this answer
This looks like exactly what I was looking for. Little snitch was indeed not doing the trick, and if hands off gets underneath that, that should let me see which applications are not using OS X's DNS facilities, and thus avoiding the tunnel. Thanks! – bhuga Nov 11 '11 at 2:28

Try using Little Snitch to see which applications are trying to use your network connection.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .