I've recently done a fresh install of Mac OS X Snow Leopard on a Macbook Pro because of a system failure. The system is bare except for what the DVD installs.

I've turned off Airport, Bluetooth, and have no wired connections. However, I'm seeing Network Packets being sent and received in Activity Monitor under the Network tab.

The tcpdump command says that no interfaces were found, but still Activity Monitor shows packets being sent and received.

How is this possible with all network devices turned off?

Are there any terminal commands that I can run to show where these network packets are coming from?

  • Have you tried disabling WiFi as well as AirPort, and BlueTooth? Also what interfaces are shown as active under Settings > Network? – BrianC Jan 10 '18 at 20:39
  • My Best guess is that is the traffic from the WiFi interface scanning for SID's and receiving their initial hand shakes. That is a guess though. – BrianC Jan 10 '18 at 20:40
  • Mtak was correct, it was traffic on the loopback interface. All the network interfaces were set to off AND the automatic configuration was also set to off. I understand that the loopback interface can be used for inter-process communication, but I don't get how or why it's classified as network activity. I guess that's another question. – Cathy A. Brink Jan 12 '18 at 1:24

Unix-based systems can have quite a lot of communication going over the loopback interface. It is one of the ways processes can communicate with each other (others are shared memory segments for example).

You can use tcpdump on the loopback interface to view the traffic:

# tcpdump -nni lo0
| improve this answer | |
  • This is exactly what I was looking for. I had to use sudo to get info on the loopback interface. What is the -nn for ? – Cathy A. Brink Jan 9 '18 at 23:34
  • Do you know how I can generate a tcpdump log from the moment the computer is turned on? – Cathy A. Brink Jan 9 '18 at 23:39
  • man tcpdump can tell you all about what tcpdump does. -nn disables reverse host and service lookups. The # indicates it's a root prompt (otherwise it'd say $). You can't generate a log when the computer is turned on, because there is no kernel yet, it can only start once the OS is booted. Search for 'how to start process when Mac OS X starts' or ask another question. – mtak Jan 10 '18 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.