Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am Mac user and few minutes ago I had to check my network traffic with tcpdump and I was surprised of the output. I send tons of requests to g1.moneybookers.com From what I see I send more than one request every second. This looks really weird to me. Should I be worried?

Do you have any idea how to detect the process which generates this traffic and kill & remove it.

PS: I haven't visit moneybookers.com in my life!

192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 57 14:26:49.499837 IP (tos 0x0, ttl 121, id 28452, offset 0, flags [none], proto UDP (17), length 94)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 66 14:26:49.500236 IP (tos 0x0, ttl 64, id 22909, offset 0, flags [none], proto UDP (17), length 94)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 66 14:26:49.506597 IP (tos 0x0, ttl 53, id 27849, offset 0, flags [none], proto UDP (17), length 84)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 56 14:26:49.507068 IP (tos 0x0, ttl 64, id 21292, offset 0, flags [none], proto UDP (17), length 84)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 56 14:26:49.519959 IP (tos 0x0, ttl 121, id 28453, offset 0, flags [none], proto UDP (17), length 94)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 66 14:26:49.520153 IP (tos 0x0, ttl 64, id 34327, offset 0, flags [none], proto UDP (17), length 94)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 66 14:26:49.529112 IP (tos 0x0, ttl 53, id 46292, offset 0, flags [none], proto UDP (17), length 87)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 59 14:26:49.529214 IP (tos 0x0, ttl 64, id 36385, offset 0, flags [none], proto UDP (17), length 87)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 59 14:26:49.542552 IP (tos 0x0, ttl 121, id 28454, offset 0, flags [none], proto UDP (17), length 97)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 69 14:26:49.543022 IP (tos 0x0, ttl 64, id 6198, offset 0, flags [none], proto UDP (17), length 97)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 69 14:26:49.544072 IP (tos 0x0, ttl 53, id 36231, offset 0, flags [none], proto UDP (17), length 95)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 67 14:26:49.544484 IP (tos 0x0, ttl 64, id 17246, offset 0, flags [none], proto UDP (17), length 95)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 67 14:26:49.550502 IP (tos 0x0, ttl 121, id 28456, offset 0, flags [none], proto UDP (17), length 100)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 72 14:26:49.550926 IP (tos 0x0, ttl 64, id 62296, offset 0, flags [none], proto UDP (17), length 100)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 72 14:26:49.565034 IP (tos 0x0, ttl 53, id 19672, offset 0, flags [none], proto UDP (17), length 124)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 96 14:26:49.565489 IP (tos 0x0, ttl 64, id 55130, offset 0, flags [none], proto UDP (17), length 124)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 96 14:26:49.571635 IP (tos 0x0, ttl 121, id 28458, offset 0, flags [none], proto UDP (17), length 93)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 65 14:26:49.571936 IP (tos 0x0, ttl 64, id 14362, offset 0, flags [none], proto UDP (17), length 93)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 65 14:26:49.589118 IP (tos 0x0, ttl 53, id 41719, offset 0, flags [none], proto UDP (17), length 158)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 130 14:26:49.589430 IP (tos 0x0, ttl 64, id 19578, offset 0, flags [none], proto UDP (17), length 158)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 130 14:26:49.591446 IP (tos 0x0, ttl 121, id 28459, offset 0, flags [none], proto UDP (17), length 98)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 70 14:26:49.591749 IP (tos 0x0, ttl 64, id 8799, offset 0, flags [none], proto UDP (17), length 98)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 70 14:26:49.600590 IP (tos 0x0, ttl 53, id 58581, offset 0, flags [none], proto UDP (17), length 124)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 96 14:26:49.600754 IP (tos 0x0, ttl 64, id 61442, offset 0, flags [none], proto UDP (17), length 124)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 96 14:26:49.611373 IP (tos 0x0, ttl 121, id 28460, offset 0, flags [none], proto UDP (17), length 93)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 65 14:26:49.611546 IP (tos 0x0, ttl 64, id 52091, offset 0, flags [none], proto UDP (17), length 93)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 65 14:26:49.623448 IP (tos 0x0, ttl 53, id 20175, offset 0, flags [none], proto UDP (17), length 129)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 101 14:26:49.623868 IP (tos 0x0, ttl 64, id 1574, offset 0, flags [none], proto UDP (17), length 129)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 101 14:26:49.634022 IP (tos 0x0, ttl 121, id 28461, offset 0, flags [none], proto UDP (17), length 94)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 66 14:26:49.634431 IP (tos 0x0, ttl 64, id 40568, offset 0, flags [none], proto UDP (17), length 94)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 66 14:26:49.651183 IP (tos 0x0, ttl 53, id 42714, offset 0, flags [none], proto UDP (17), length 155)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 127 14:26:49.651415 IP (tos 0x0, ttl 64, id 12561, offset 0, flags [none], proto UDP (17), length 155)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 127 14:26:49.652708 IP (tos 0x0, ttl 121, id 28462, offset 0, flags [none], proto UDP (17), length 103)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 75 14:26:49.652982 IP (tos 0x0, ttl 64, id 42529, offset 0, flags [none], proto UDP (17), length 103)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 75 14:26:49.670068 IP (tos 0x0, ttl 53, id 47327, offset 0, flags [none], proto UDP (17), length 142)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 114 14:26:49.670301 IP (tos 0x0, ttl 64, id 8759, offset 0, flags [none], proto UDP (17), length 142)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 114 14:26:49.672592 IP (tos 0x0, ttl 121, id 28463, offset 0, flags [none], proto UDP (17), length 152)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 124 14:26:49.672875 IP (tos 0x0, ttl 64, id 569, offset 0, flags [none], proto UDP (17), length 152)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 124 14:26:49.680573 IP (tos 0x0, ttl 53, id 37605, offset 0, flags [none], proto UDP (17), length 151)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 123 14:26:49.680800 IP (tos 0x0, ttl 64, id 30751, offset 0, flags [none], proto UDP (17), length 151)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 123 14:26:49.692750 IP (tos 0x0, ttl 121, id 28464, offset 0, flags [none], proto UDP (17), length 155)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 127 14:26:49.693022 IP (tos 0x0, ttl 64, id 38948, offset 0, flags [none], proto UDP (17), length 155)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 127 14:26:49.703590 IP (tos 0x0, ttl 53, id 1737, offset 0, flags [none], proto UDP (17), length 153)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 125 14:26:49.703978 IP (tos 0x0, ttl 64, id 7771, offset 0, flags [none], proto UDP (17), length 153)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 125 14:26:49.716977 IP (tos 0x0, ttl 121, id 28465, offset 0, flags [none], proto UDP (17), length 153)
    g1.moneybookers.com.60709 > 192.168.1.100.59146: [udp sum ok] UDP, length 125 14:26:49.717401 IP (tos 0x0, ttl 64, id 46124, offset 0, flags [none], proto UDP (17), length 153)
    192.168.1.100.59146 > 89.246.238.132.55468: [udp sum ok] UDP, length 125 14:26:49.727574 IP (tos 0x0, ttl 53, id 19391, offset 0, flags [none], proto UDP (17), length 143)
    89.246.238.132.55468 > 192.168.1.100.59146: [udp sum ok] UDP, length 115 14:26:49.727919 IP (tos 0x0, ttl 64, id 30270, offset 0, flags [none], proto UDP (17), length 143)
    192.168.1.100.59146 > g1.moneybookers.com.60709: [udp sum ok] UDP, length 115
share|improve this question

migrated from serverfault.com Aug 8 '13 at 11:59

This question came from our site for professional system and network administrators.

    
What operating system is this log from ( its not clear by your statements ) just that you are a Mac user which could mean your not experienced in the operating system in question. The simplest solution would be to verify every process that is running you should be able to identify the process you didn't start. –  Ramhound Aug 8 '13 at 12:05
    
There's applications specifically meant to track this sort of thing now. I'm not a mac user, so I have no clue if there's good, free alternatives, but little snitch might be worth looking at. –  Journeyman Geek Aug 8 '13 at 12:06
    
Always run tcpdump with the -n option. –  Michael Hampton Aug 8 '13 at 12:14
    
To clarify, I am using OS X Mountain Lion 10.8.4. Also there are processes which I haven't start, but they are perfectly safe. –  Ivan Dokov Aug 8 '13 at 12:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.