Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On my mac (Lion), I know that curl is bing used by some unknown process to communicate with a server.

Basically I installed little Snitch and find out that "somebody" is using curl periodically.
How can I find out who (what process) is firing up these curl calls?
I guess if a process is directly calling curl I should be able to find who it is (if it is still around by the time I look for it) by checking the process tree (parent to curl).

Are there any best practices or specialized utilities to help with this?

share|improve this question
add comment

3 Answers

up vote 9 down vote accepted
sudo cp /usr/bin/curl /usr/bin/curl.bin
sudo vim /usr/bin/curl.wrapper

here is the wrapper:

#!/bin/sh

date >> /var/tmp/curl_ppid.log
ps -f -p $PPID >> /var/tmp/curl_ppid.log

exec curl.bin "$@"

and then:

sudo chmod 755 /usr/bin/curl.wrapper
sudo touch /var/tmp/curl_ppid.log
sudo chmod a+w /var/tmp/curl_ppid.log
sudo ln -sf /usr/bin/curl.wrapper /usr/bin/curl

It is better to keep the wrapper script in another location called curl.wrapper, so your package manager will not overwrite your script during an update.

share|improve this answer
2  
Fantastic, it was prey preyproject.com ! I didn't know it keeps checking my connectivity by curling google.com . Phew! –  Ali Jan 18 '12 at 17:22
add comment

Because MacOS is Unix-based, "lsof" command will work.

Try:

sudo lsof -i -P | grep -i "curl"

or just

lsof -i
share|improve this answer
    
Really? lsof -i should show curl itself but not the parent process (the one calling curl). –  Ali Jan 17 '12 at 20:10
2  
Sorry, I'm so used to having to interpret poor grammar on this site that I actually interpreted your proper grammar incorrectly. I thought you were looking for a user who is calling a process ... Feel free to disregard. –  schroeder Jan 17 '12 at 20:36
add comment

Replace the curl binary with a script to capture the process details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.