This question already has an answer here:
Firstly, I welcome a better title for this question. I admit I'm a security novice.
I'm trying to determine whether I have malware and what that malware may be doing. Using Wireshark, I see several suspicious streams, including addresses ending in .ln and .ch that send all data encrypted. When I run
whois it always times out, unless I specify explicitly the whois server to use (this is itself suspicious to me), so I've resorted to using an online client at http://whois.domaintools.com/.
One stream that is more consistently present goes to lga15s42-in-f21.1e100.net, every few seconds, and is sending over TLSv1.2. Packets are often of fixed sizes (60, 107, 125) but are sometimes larger and not repeated sizes.
~The whois entry for 1e100.net is particularly suspicious to me.~ Scratch that. I had invalid entry by mistyping the domain. Actual entry is for Google, Inc, which greatly reduces suspicion of this traffic.
Amended question, since the traffic would seem to be going to Google: why is Google sending this info over TLS on a non-standard port? Is that basically the way they should send background queries? It is annoying because to a security novice (or for that matter, not a novice), such traffic adds noise. I would be happier if such queries went over clear-text on standard protocols, as I'm trying to figure out if I've been rooted.
ps. Should have mentioned, the computer in question is a MacBook Air Retina Pro, running OS X 10.9.3.