Eu tenho um Macbook com o firewall da PF instalado no Icefloor. Tenho visto uma enorme quantidade de tráfego (várias solicitações a cada segundo) saindo para os IPs pertencentes ao Google, mesmo quando meu computador está ocioso. Não tenho nenhum software relacionado ao Google no meu laptop, por isso não consigo descobrir qual programa está enviando esse tráfego. Parece isso nos logs (desculpe se é ilegível):
00:00:00.210298 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61141 > 74.125.239.46.443: Flags [S], seq 2894619202, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000022 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61140 > 74.125.239.46.443: Flags [S], seq 1043451854, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000329 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611114282 ecr 0,sackOK,eol], length 0
00:00:00.000122 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611114282 ecr 0,sackOK,eol], length 0
00:00:01.104061 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611115380 ecr 0,sackOK,eol], length 0
00:00:00.000021 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611115380 ecr 0,sackOK,eol], length 0
00:00:01.104240 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116479 ecr 0,sackOK,eol], length 0
00:00:00.000012 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116479 ecr 0,sackOK,eol], length 0
00:00:00.401585 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116878 ecr 0,sackOK,eol], length 0
00:00:00.200267 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61121 > 74.125.239.115.80: Flags [S], seq 2827866371, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000028 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61120 > 74.125.239.114.80: Flags [S], seq 494227975, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000220 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117078 ecr 0,sackOK,eol], length 0
00:00:00.500626 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117577 ecr 0,sackOK,eol], length 0
00:00:00.000015 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117577 ecr 0,sackOK,eol], length 0
00:00:00.401023 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117977 ecr 0,sackOK,eol], length 0
00:00:00.201283 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611118178 ecr 0,sackOK,eol], length 0
e
00:00:00.000021 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100267 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611125783 ecr 0,sackOK,eol], length 0
00:00:00.000019 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611125783 ecr 0,sackOK,eol], length 0
00:00:01.102604 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611126881 ecr 0,sackOK,eol], length 0
00:00:00.000020 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611126881 ecr 0,sackOK,eol], length 0
00:00:01.104752 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611127980 ecr 0,sackOK,eol], length 0
00:00:00.000015 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611127980 ecr 0,sackOK,eol], length 0
00:00:00.200789 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61123 > 74.125.239.114.80: Flags [S], seq 3185633232, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100509 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000031 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61125 > 74.125.239.115.80: Flags [S], seq 2940959116, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100484 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,sackOK,eol], length 0
Alguém poderia me dizer se há uma maneira de identificar qual programa está enviando esse tráfego para esses endereços IP?
Existe um programa chamado Little Snitch (US $ 35) que permite que você veja qual tráfego vem de qual aplicativo e permite que você permita ou negue o tráfego seletivamente. Ele também permite que você bloqueie serviços específicos de aplicativos e crie perfis de configurações diferentes (ou seja, desative rapidamente a verificação de atualizações e o Spotify se estiver conectado ao telefone). Custo para uso único, mas surpreendentemente útil.
Você pode executar lsof -i -n para ver a lista de conexões atuais. Ele mostra o nome do processo e o PID nas duas primeiras colunas.
lsof é um programa que lista arquivos abertos e soquetes de rede. -i significa exibir apenas conexões de rede, -n desativa a resolução do host.
Então, você pode usar isso para identificar o aplicativo:
lsof -i -n | grep 74.125.239
E se a primeira coluna não ajudar você a identificar o aplicativo, você pode pegar o PID e pesquisá-lo em ps aux .