Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Macbook with the PF firewall Icefloor installed on it. I've been seeing a massive amount of traffic (multiple requests every single second) going out to IPs belonging to Google, even while my computer is idle. I do not have any Google-related software on my laptop, so I can't figure out what program is sending this traffic. It looks like this in the logs (sorry if it's unreadable):

00:00:00.210298 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61141 > 74.125.239.46.443: Flags [S], seq 2894619202, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000022 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61140 > 74.125.239.46.443: Flags [S], seq 1043451854, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000329 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611114282 ecr 0,sackOK,eol], length 0
00:00:00.000122 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611114282 ecr 0,sackOK,eol], length 0
00:00:01.104061 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611115380 ecr 0,sackOK,eol], length 0
00:00:00.000021 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611115380 ecr 0,sackOK,eol], length 0
00:00:01.104240 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116479 ecr 0,sackOK,eol], length 0
00:00:00.000012 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116479 ecr 0,sackOK,eol], length 0
00:00:00.401585 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116878 ecr 0,sackOK,eol], length 0
00:00:00.200267 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61121 > 74.125.239.115.80: Flags [S], seq 2827866371, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000028 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61120 > 74.125.239.114.80: Flags [S], seq 494227975, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000220 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117078 ecr 0,sackOK,eol], length 0
00:00:00.500626 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117577 ecr 0,sackOK,eol], length 0
00:00:00.000015 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117577 ecr 0,sackOK,eol], length 0
00:00:00.401023 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117977 ecr 0,sackOK,eol], length 0
00:00:00.201283 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611118178 ecr 0,sackOK,eol], length 0

and

00:00:00.000021 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100267 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611125783 ecr 0,sackOK,eol], length 0
00:00:00.000019 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611125783 ecr 0,sackOK,eol], length 0
00:00:01.102604 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611126881 ecr 0,sackOK,eol], length 0
00:00:00.000020 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611126881 ecr 0,sackOK,eol], length 0
00:00:01.104752 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611127980 ecr 0,sackOK,eol], length 0
00:00:00.000015 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611127980 ecr 0,sackOK,eol], length 0
00:00:00.200789 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61123 > 74.125.239.114.80: Flags [S], seq 3185633232, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100509 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000031 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61125 > 74.125.239.115.80: Flags [S], seq 2940959116, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100484 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,sackOK,eol], length 0

Could someone tell me if there's a way to identify what program is sending this traffic to these IP addresses?

share|improve this question
    
thank you so much for the edit! –  user242366 Jul 31 '13 at 23:26
    
Have you tried Wireshark wireshark.org/download.html –  malakrsnaslava Aug 1 '13 at 7:42
add comment

2 Answers

There is a program called Little Snitch ($35) that will let you to see what traffic comes from what application, and let you allow or deny traffic selectively. It also lets you to block specific services of applications and create different settings profiles (ie. quickly disable update checking and Spotify if you're tethered to your phone). Costly for one time use, but surprisingly useful.

share|improve this answer
add comment

You can execute lsof -i -n to see the list of current connections. It shows the process name and PID in the first two columns.

lsof is a program that lists open files and network sockets. -i stands for displaying only network connections, -n disables host resolving.

So, you can use that to identify the app:

lsof -i -n | grep 74.125.239

And if the first column didn't help you to identify the application, you can take PID and search for it in ps aux.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.