¿Cómo identificar qué programa está enviando tráfico?

3

Tengo un Macbook con el firewall PF Icefloor instalado en él. He estado viendo una gran cantidad de tráfico (múltiples solicitudes cada segundo) que se dirige a las IP que pertenecen a Google, incluso cuando mi computadora está inactiva. No tengo ningún software relacionado con Google en mi computadora portátil, por lo que no puedo averiguar qué programa está enviando este tráfico. Se ve así en los registros (perdón si es ilegible):

00:00:00.210298 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61141 > 74.125.239.46.443: Flags [S], seq 2894619202, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000022 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61140 > 74.125.239.46.443: Flags [S], seq 1043451854, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000329 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611114282 ecr 0,sackOK,eol], length 0
00:00:00.000122 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611114282 ecr 0,sackOK,eol], length 0
00:00:01.104061 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611115380 ecr 0,sackOK,eol], length 0
00:00:00.000021 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611115380 ecr 0,sackOK,eol], length 0
00:00:01.104240 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116479 ecr 0,sackOK,eol], length 0
00:00:00.000012 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116479 ecr 0,sackOK,eol], length 0
00:00:00.401585 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611116878 ecr 0,sackOK,eol], length 0
00:00:00.200267 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61121 > 74.125.239.115.80: Flags [S], seq 2827866371, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000028 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61120 > 74.125.239.114.80: Flags [S], seq 494227975, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000220 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117078 ecr 0,sackOK,eol], length 0
00:00:00.500626 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61143 > 74.125.239.38.443: Flags [S], seq 1475886131, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117577 ecr 0,sackOK,eol], length 0
00:00:00.000015 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117577 ecr 0,sackOK,eol], length 0
00:00:00.401023 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611117977 ecr 0,sackOK,eol], length 0
00:00:00.201283 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611118178 ecr 0,sackOK,eol], length 0

y

00:00:00.000021 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61142 > 74.125.239.38.443: Flags [S], seq 3844968709, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100267 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611125783 ecr 0,sackOK,eol], length 0
00:00:00.000019 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611125783 ecr 0,sackOK,eol], length 0
00:00:01.102604 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611126881 ecr 0,sackOK,eol], length 0
00:00:00.000020 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611126881 ecr 0,sackOK,eol], length 0
00:00:01.104752 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61148 > 74.125.239.115.80: Flags [S], seq 3938563181, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611127980 ecr 0,sackOK,eol], length 0
00:00:00.000015 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61147 > 74.125.239.114.80: Flags [S], seq 569830445, win 65535, options [mss 1460,nop,wscale 4,nop,nop,TS val 611127980 ecr 0,sackOK,eol], length 0
00:00:00.200789 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61123 > 74.125.239.114.80: Flags [S], seq 3185633232, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100509 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61144 > 74.125.239.114.80: Flags [S], seq 1846641104, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.000031 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61125 > 74.125.239.115.80: Flags [S], seq 2940959116, win 65535, options [mss 1460,sackOK,eol], length 0
00:00:00.100484 rule 1.800.icefloor.5/0(match): block out on en0: 69.181.243.26.61145 > 74.125.239.115.80: Flags [S], seq 3019819231, win 65535, options [mss 1460,sackOK,eol], length 0

¿Podría alguien decirme si hay una manera de identificar qué programa está enviando este tráfico a estas direcciones IP?

— user242366
fuente

¿Has probado Wireshark wireshark.org/download.html

— malakrsnaslava

1

Hay un programa llamado Little Snitch ($ 35) que le permitirá ver qué tráfico proviene de qué aplicación, y le permite permitir o denegar el tráfico de forma selectiva. También le permite bloquear servicios específicos de aplicaciones y crear diferentes perfiles de configuración (es decir, deshabilitar rápidamente la comprobación de actualizaciones y Spotify si está atado a su teléfono). Costoso para un solo uso, pero sorprendentemente útil.

— Seth
fuente

0

Puedes ejecutar lsof -i -n Para ver la lista de conexiones actuales. Muestra el nombre del proceso y el PID en las dos primeras columnas.

lsof es un programa que enumera archivos abiertos y sockets de red. -i significa solo mostrar conexiones de red, -n deshabilita la resolución del host.

Entonces, puedes usar eso para identificar la aplicación:

lsof -i -n | grep 74.125.239

Y si la primera columna no le ayudó a identificar la aplicación, puede tomar PID y buscarla en ps aux.

— Igor Hatarist
fuente