I am running a properly configured pf_config ( at least, sort of properly configured ) and have wiped my hard drive clean 3 times with a fresh install of OSX Maverick.

I find it odd that my laptop is attempting to connect to any outside without me doing anything.

This scenario brings me to the root of my question. How can I associate these outside access attempts with the PID of the offending application?

2 Answers 2


Akamai's content delivery network is used by various software vendors, including Apple, to distribute software updates. It could very well be one of your applications (or OSX itself) checking if any updates are available.

If you want to know which application is accessing which sites, you can use netstat -pant or install a firewall like Little Snitch, which will inform about and/or ask permission for all outbound connections.


If you are looking to find out the current TCP connections and their programs/PIDs, you can start by running netstat -antp, where the -p option shows the PID for each connection. If you have a very busy box, with lots of connection, pipe the output to a more command, like this: netstat -antp | more.

For completeness' sake, correlate the information with either the top command or ps aux.

I am not 100% sure on Macs, though; sorry. Feel free to play about with the netstat on Mac OS. Also, you can refer to their online man page here.

If you feel the need to do a deeper inspection, once you have performed the aforementioned steps, try a packet sniffer, such as Wireshark.

Even if you do not manage to find out what it is - you should be able, but assuming you couldn't, you could still block the outgoing connection at the local machine, and/or blocking the IP from entering your network at the perimeter level by blocking incoming connections on your router.


For Macs you might try lsof -i 4tcp, which would give you the output in the following order:


  • Your answer is 100% sure on Macs ☺. James is already attacking the filtering of unknown trafic the right way. I wouldn't advise him to do it one step further (perimeter level) because MacOS X (like many other Unixes) provide all the necessary tools to block efficiently what goes in and out of your system.
    – dan
    Dec 4, 2013 at 12:29
  • @danielAzuelos - Thanks so much for your feedback: I am not very Mac-literate. If the traffic is not so huge, your approach of using Mac's own features might do. The advantage of blocking at the perimeter level if the traffic is too high, is that by doing that, you don't waste the computer's resources.
    – Lex
    Dec 4, 2013 at 14:32
  • lsof -i 4tcp is very useful. My thought now is since I am blocking connections how can I be sure to capture this information. lsof seems to not be streamed but queried by the system. Also no connection is established. Dec 4, 2013 at 18:09
  • @JamesAndino - I would say that for a confident and reliable report on that, you could either have a box acting as a SIEM (Security Information Event Management) system such as Splunk or AlienVault on your network. If you don't want to install it and go through this hassle, you can enable logging on your perimeter router/firewall if you have blocked the IP from coming into your network.
    – Lex
    Dec 5, 2013 at 9:51
  • That makes me feel much less crazy on just about everything in life. Dec 5, 2013 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .