Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server.

Basically I installed little Snitch and find out that "somebody" is using curl periodically.
How can I find out who (what process) is firing up these curl calls?
I guess if a process is directly calling curl I should be able to find who it is (if it is still around by the time I look for it) by checking the process tree (parent to curl).

Are there any best practices or specialized utilities to help with this?

share|improve this question
up vote 12 down vote accepted
sudo cp /usr/bin/curl /usr/bin/curl.bin
sudo vim /usr/bin/curl.wrapper

here is the wrapper:


date >> /var/tmp/curl_ppid.log
ps -f -p $PPID >> /var/tmp/curl_ppid.log

exec curl.bin "$@"

and then:

sudo chmod 755 /usr/bin/curl.wrapper
sudo touch /var/tmp/curl_ppid.log
sudo chmod a+w /var/tmp/curl_ppid.log
sudo ln -sf /usr/bin/curl.wrapper /usr/bin/curl

It is better to keep the wrapper script in another location called curl.wrapper, so your package manager will not overwrite your script during an update.

share|improve this answer
Fantastic, it was prey ! I didn't know it keeps checking my connectivity by curling . Phew! – Ali Jan 18 '12 at 17:22

Replace the curl binary with a script to capture the process details.

share|improve this answer

Because MacOS is Unix-based, "lsof" command will work.


sudo lsof -i -P | grep -i "curl"

or just

lsof -i
share|improve this answer
Really? lsof -i should show curl itself but not the parent process (the one calling curl). – Ali Jan 17 '12 at 20:10
Sorry, I'm so used to having to interpret poor grammar on this site that I actually interpreted your proper grammar incorrectly. I thought you were looking for a user who is calling a process ... Feel free to disregard. – schroeder Jan 17 '12 at 20:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.