-1

When reinstalling MacOS High Sierra, setting root user password I have noticed strange line dsl-201-101-1-179-sta: before my admin username user$.

I Googled and found references to WannaCry ransomware, for instance this. Other references showed IP with Mexican DSL provider dsl-201-100-226-146-sta.prod-empresarial.com.mx.

I am really not sure how it came to be but it does not matter how many times I reinstall my Mac. After a while this comes up in my terminal. I have never used Windows on this computer and it was wiped securely through disk utility before fresh install many times.

Last login: Sat Mar 10 13:13:20 on ttys000
dsl-201-101-1-179-sta:~ user$ lsof -i | grep LISTEN

rapportd   258 user    3u  IPv4 0x6ee1327a4ca5e447      0t0  TCP *:49169 (LISTEN)

rapportd   258 user    4u  IPv6 0x6ee1327a4cb40e3f      0t0  TCP *:49169 (LISTEN)

migrated from stackoverflow.com Apr 11 '18 at 4:23

This question came from our site for professional and enthusiast programmers.

5

Short answer: this is not an indication of a problem, just a side effect of the somewhat haphazard way things try to figure out your computer's "name".

Long answer: The standard command prompt includes the computer's hostname, the directory you're in, and your username. The problem here is how the "hostname" is determined. You probably have a computer name set in System Preferences -> Sharing, right? Well, it'll sometimes use that... but before "trusting" that it tries a reverse DNS lookup on your primary IP address, and if it gets back a name from the DNS server, it treats that as more authoritative than what you put in Sharing prefs. But often the DNS server doesn't really have a name to go with your IP address so it makes something up, or takes a guess, or something like that, and you wind up with something weird in your prompt.

In this case, I'm guessing your Mac's primary IP address is 201.100.226.146, right? A reverse DNS lookup on that gives the full DNS name dsl-201-100-226-146-sta.prod-empresarial.com.mx, so your Mac takes the hostname portion -- the bit before the first "." -- and uses that as your hostname. Resetting your Mac won't have any effect on it, because it's coming from your Internet connection. But if you switch Internet connections -- say, by going to the local coffee shop and using their Internet -- you'll get a different name (or no DNS name, in which case it'll use what you put in the Sharing prefs).

If it really bugs you, you can override it with sudo scutil --set HostName "hostnameyoudratheruse", but I wouldn't bother; just ignore it.

As for the info you're getting from lsof, it's a bit unclear what rapportd does, but it seems to be a standard Apple process, not anything suspicious. See "What is rapportd and why does it want incoming network connections?" on Ask Different.

  • +1 for Long answer pointing to DNS ... it should also be noted that as of right now current variants of WannaCry do not effect Mac (though this could change in the future) – CaffeineAddiction Apr 12 '18 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy