Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've got a personal firewall running on my Mac (Little Snitch) and for the past couple of days, periodically, it's telling me that something is trying to connect via SMPT – but it does not tell me what is trying to connect.

I know it's none of my normal apps, as they all have rules to allow or disallow them already.

I've been denying the requests but want to find out what is trying to send an e-mail. It concerns me and makes me think it's something nasty!

Any ideas on what I can do to identify the source and see what it's trying to send?

share|improve this question
    
Seems like a design flaw of the interface if it tells you something is attempting to make a smtp connection but doesn't tell you which process. Are there perhaps more details logs that exist? Besides looking at the logs itself I don't see how we can help you considering the firewall of choice doesn't even tell you what process it is. –  Ramhound Dec 10 '12 at 14:40
    
@Ramhound Well, normally little snitch would tell you all you need to know, but in this instance there is no information of use. That process is simply SMTP, and nothing more. That is the confusing part! –  John Dec 10 '12 at 14:43
    
@slhck Well, that is the other odd thing, it's trying to connect to the google dns servers 8.8.8.8, 8.8.8.4 and then 10.0.0.1. What is 10.0.0.1? Some kind of broadcast attempt? –  John Dec 10 '12 at 15:13
    
Ah right, ok, it's showing me that it's postfix - /usr/libexec/postfix/smtp and user _postfix (UID: 27) but that could be anything trying to send via postfix i guess. How would i then identify what is trying to use postfix? –  John Dec 10 '12 at 15:15
    
Yes, that would be Google DNS and 10.0.0.1 is default gateway address if you happen to be in the same subnet. It's not a broadcast though, technically speaking. –  slhck Dec 10 '12 at 15:15
show 2 more comments

1 Answer

up vote 1 down vote accepted

OSX Lion has the handy nettop command line utility which should help you track down the culprit. From terminal just type nettop and you'll get a scrollable list of current processes using networking. Use the arrow keys to navigate up/down and left/right to contract/expand the list of processes.

This is where I found out about it: http://superuser.com/a/362902/164459 and there's a couple of alternatives there too.

share|improve this answer
    
Hmm, that looks handy, not sure that tells me much more than activity monitor, but next time it pops up i'll certainly have a look. Cheers! –  John Dec 10 '12 at 15:12
    
Going to have to give you the tick for the solution as your suggestion helped me track down the process :) Thanks! –  John Dec 10 '12 at 15:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.