Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am running a properly configured pf_config ( at least, sort of properly configured ) and have wiped my hard drive clean 3 times with a fresh install of OSX Maverick.

I find it odd that my laptop is attempting to connect to any outside without me doing anything.

This scenario brings me to the root of my question. How can I associate these outside access attempts with the PID of the offending application?

share|improve this question
add comment

2 Answers

Akamai's content delivery network is used by various software vendors, including Apple, to distribute software updates. It could very well be one of your applications (or OSX itself) checking if any updates are available.

If you want to know which application is accessing which sites, you can use netstat -pant or install a firewall like Little Snitch, which will inform about and/or ask permission for all outbound connections.

share|improve this answer
add comment

If you are looking to find out the current TCP connections and their programs/PIDs, you can start by running netstat -antp, where the -p option shows the PID for each connection. If you have a very busy box, with lots of connection, pipe the output to a more command, like this: netstat -antp | more.

For completeness' sake, correlate the information with either the top command or ps aux.

I am not 100% sure on Macs, though; sorry. Feel free to play about with the netstat on Mac OS. Also, you can refer to their online man page here.

If you feel the need to do a deeper inspection, once you have performed the aforementioned steps, try a packet sniffer, such as Wireshark.

Even if you do not manage to find out what it is - you should be able, but assuming you couldn't, you could still block the outgoing connection at the local machine, and/or blocking the IP from entering your network at the perimeter level by blocking incoming connections on your router.


Update

For Macs you might try lsof -i 4tcp, which would give you the output in the following order:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

share|improve this answer
    
Your answer is 100% sure on Macs ☺. James is already attacking the filtering of unknown trafic the right way. I wouldn't advise him to do it one step further (perimeter level) because MacOS X (like many other Unixes) provide all the necessary tools to block efficiently what goes in and out of your system. –  daniel Azuelos Dec 4 '13 at 12:29
    
@danielAzuelos - Thanks so much for your feedback: I am not very Mac-literate. If the traffic is not so huge, your approach of using Mac's own features might do. The advantage of blocking at the perimeter level if the traffic is too high, is that by doing that, you don't waste the computer's resources. –  Lex Dec 4 '13 at 14:32
    
lsof -i 4tcp is very useful. My thought now is since I am blocking connections how can I be sure to capture this information. lsof seems to not be streamed but queried by the system. Also no connection is established. –  James Andino Dec 4 '13 at 18:09
    
@JamesAndino - I would say that for a confident and reliable report on that, you could either have a box acting as a SIEM (Security Information Event Management) system such as Splunk or AlienVault on your network. If you don't want to install it and go through this hassle, you can enable logging on your perimeter router/firewall if you have blocked the IP from coming into your network. –  Lex Dec 5 '13 at 9:51
    
That makes me feel much less crazy on just about everything in life. –  James Andino Dec 5 '13 at 16:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.