🚀 go-pugleaf

In article <siegman-E4BA74.10091903082008@news.stanford.edu>,
 AES <siegman@stanford.edu> wrote:

> I just started up NT-NewsWatcher on my Airport+DSL-connected MacBook a 
> few moments ago, noticed that the "?"'s in front of the 26 groups in my 
> Subscribed Groups window were only very slowly turning into numbers of 
> new messages, but also observed that the activity light on my DSL modem 
> was flashing like mad. 
> 
> So, I started up Activity Monitor (which I don't normally keep running), 
> and selected the Network Tab.  The  text at the bottom of AM's window is 
> showing "Data Received: 93 MB" and climbing steadily; the green line in 
> the little window to the right of that is pegged at the top of the 
> window and the text says "Data received/sec" is about 40 kB (which might 
> be about right for our very marginal DSL connection).
> 
> So, how can I tell _where_ this data is going on my HD, or who's sending 
> it to me?
> 
> And, I started up Activity Monitor cold, and the 93+ MB can't possibly 
> have come in since I started it.  From what starting point does Activity 
> Monitor measure Data Received? -- and does it somehow keep track even 
> when it's not Open?
> 
> [In the time it took to compose this msg, the Data Received has climbed 
> to 120 MB . .. ]

Try this in a terminal window:

     netstat -a | grep ESTABLISHED

-- 
Send responses to the relevant news group rather than to me, as
E-mail sent to this address may be devoured by my very hungry SPAM
filter. Due to Google's refusal to prevent spammers from posting
messages through their servers, I often ignore posts from Google
Groups. Use a real news client if you want me to see your posts.

JR

In article <jollyroger-9126A2.12143803082008@news.individual.net>,
 Jolly Roger <jollyroger@pobox.com> wrote:

> In article <siegman-E4BA74.10091903082008@news.stanford.edu>,
>  AES <siegman@stanford.edu> wrote:
> 
> > I just started up NT-NewsWatcher on my Airport+DSL-connected MacBook a 
> > few moments ago, noticed that the "?"'s in front of the 26 groups in my 
> > Subscribed Groups window were only very slowly turning into numbers of 
> > new messages, but also observed that the activity light on my DSL modem 
> > was flashing like mad. 
> > 
> > So, I started up Activity Monitor (which I don't normally keep running), 
> > and selected the Network Tab.  The  text at the bottom of AM's window is 
> > showing "Data Received: 93 MB" and climbing steadily; the green line in 
> > the little window to the right of that is pegged at the top of the 
> > window and the text says "Data received/sec" is about 40 kB (which might 
> > be about right for our very marginal DSL connection).
> > 
> > So, how can I tell _where_ this data is going on my HD, or who's sending 
> > it to me?
> > 
> > And, I started up Activity Monitor cold, and the 93+ MB can't possibly 
> > have come in since I started it.  From what starting point does Activity 
> > Monitor measure Data Received? -- and does it somehow keep track even 
> > when it's not Open?
> > 
> > [In the time it took to compose this msg, the Data Received has climbed 
> > to 120 MB . .. ]
> 
> Try this in a terminal window:
> 
>      netstat -a | grep ESTABLISHED

And don't be surprised when you find out that something like 3.7 metric 
buttloads of the incoming data is nothing more or less than bot-net 
generated spam traffic. 

I was rather shocked to fire up a packet-sniffer and watch megs upon 
megs of crap coming in, practically non-stop, with almost all of it 
consisting of UDP-broadcast packets coming in on the iCal port. Had the 
packets been coming in on the email port via TCP, they would have been 
hundreds, if not thousands, of email messages, all variations on a theme 
of "STOP! Your Windows registry is corrupt - go to <some website> and 
get this registry cleaner and these warnings will stop appearing." 

Funny... I don't recall having a Windows registry to be corrupted, never 
mind a need for something to fix it... :) 

And then, there's the strangeness that these emails are being shipped to 
the iCal port. Wazzup with that? :)

-- 
Don Bruder - dakidd@sonic.net - If your "From:" address isn't on my whitelist,
or the subject of the message doesn't contain the exact text "PopperAndShadow"
somewhere, any message sent to this address will go in the garbage without my
ever knowing it arrived. Sorry... <http://www.sonic.net/~dakidd> for more info

In article <_rydnY1XH8vIYQjVnZ2dnUVZ_u2dnZ2d@comcast.com>,
 Don Bruder <dakidd@sonic.net> wrote:

> In article <jollyroger-9126A2.12143803082008@news.individual.net>,
>  Jolly Roger <jollyroger@pobox.com> wrote:
> 
> > In article <siegman-E4BA74.10091903082008@news.stanford.edu>,
> >  AES <siegman@stanford.edu> wrote:
> > 
> > > So, how can I tell _where_ this data is going on my HD, or who's sending 
> > > it to me?
> > 
> > Try this in a terminal window:
> > 
> >      netstat -a | grep ESTABLISHED
> 
> And don't be surprised when you find out that something like 3.7 metric 
> buttloads of the incoming data is nothing more or less than bot-net 
> generated spam traffic. 
> 

Actually, for me (MacBook on DSL connection), it wasn't that bad:  Turns 
out it was just Apples latest OS X security upgrade being automatically 
downloaded: about 150 MB.

I don't too much mind these downloads being automatically pushed at me, 
except maybe when I'm trying to do something else online and one of them 
starts up, begins chewing up all my limited DSL bandwidth, and slows my 
own use of the connection to a crawl.

But still, two questions:

1)  If I see my DSL modem's status light flashing madly and Activity 
Monitor tells me something big is being shoved at me, is there a way (in 
AM) to see what it is or where it's going on my HD?

2)  Are there OS X (Tiger) prefs I can set to control when these 
upgrades will be sent, or to have Apple ask before sending?

Thanks for any assistance.

Don Bruder wrote:
> And don't be surprised when you find out that something like 3.7 metric 
> buttloads of the incoming data is nothing more or less than bot-net 
> generated spam traffic. 
> 
> I was rather shocked to fire up a packet-sniffer and watch megs upon 
> megs of crap coming in, practically non-stop, with almost all of it 
> consisting of UDP-broadcast packets coming in on the iCal port. Had the 

Perhaps you could benefit with some adjustment of something somewhere.

I just ran tcpdump here for approximately a half-hour.
I filtered out anything sourced on our LAN, so it was
only incoming.

407 items.
164 were nntp
140 were pop3
104 were ??? not IP, probably arp, len 52
(Can't tell because I used awk to only catch size, src/port, dest/port)


-- 
Wes Groleau
-----------

    "Thinking I'm dumb gives people something to
     feel smug about.  Why should I disillusion them?"
                             -- Charles Wallace
                             (in _A_Wrinkle_In_Time_)

In article <siegman-5DF7C7.13055203082008@news.stanford.edu>,
 AES <siegman@stanford.edu> wrote:

> In article <_rydnY1XH8vIYQjVnZ2dnUVZ_u2dnZ2d@comcast.com>,
>  Don Bruder <dakidd@sonic.net> wrote:
> 
> > In article <jollyroger-9126A2.12143803082008@news.individual.net>,
> >  Jolly Roger <jollyroger@pobox.com> wrote:
> > 
> > > In article <siegman-E4BA74.10091903082008@news.stanford.edu>,
> > >  AES <siegman@stanford.edu> wrote:
> > > 
> > > > So, how can I tell _where_ this data is going on my HD, or who's 
> > > > sending 
> > > > it to me?
> > > 
> > > Try this in a terminal window:
> > > 
> > >      netstat -a | grep ESTABLISHED
> > 
> > And don't be surprised when you find out that something like 3.7 metric 
> > buttloads of the incoming data is nothing more or less than bot-net 
> > generated spam traffic. 
> > 
> 
> Actually, for me (MacBook on DSL connection), it wasn't that bad:  Turns 
> out it was just Apples latest OS X security upgrade being automatically 
> downloaded: about 150 MB.
> 
> I don't too much mind these downloads being automatically pushed at me, 
> except maybe when I'm trying to do something else online and one of them 
> starts up, begins chewing up all my limited DSL bandwidth, and slows my 
> own use of the connection to a crawl.
> 
> But still, two questions:
> 
> 1)  If I see my DSL modem's status light flashing madly and Activity 
> Monitor tells me something big is being shoved at me, is there a way (in 
> AM) to see what it is or where it's going on my HD?

Not in Activity Monitor, nope.  This is why tools like "netstat" exist.  
; )

> 2)  Are there OS X (Tiger) prefs I can set to control when these 
> upgrades will be sent, or to have Apple ask before sending?

Clear the System Preferences > Software Update > "Download important 
updates automatically" checkbox.

-- 
Send responses to the relevant news group rather than to me, as
E-mail sent to this address may be devoured by my very hungry SPAM
filter. Due to Google's refusal to prevent spammers from posting
messages through their servers, I often ignore posts from Google
Groups. Use a real news client if you want me to see your posts.

JR

In article <%golk.104$ZV1.97@trnddc07>,
 Wes Groleau <groleau+news@freeshell.org> wrote:

> Don Bruder wrote:
> > And don't be surprised when you find out that something like 3.7 metric 
> > buttloads of the incoming data is nothing more or less than bot-net 
> > generated spam traffic. 
> > 
> > I was rather shocked to fire up a packet-sniffer and watch megs upon 
> > megs of crap coming in, practically non-stop, with almost all of it 
> > consisting of UDP-broadcast packets coming in on the iCal port. Had the 
> 
> Perhaps you could benefit with some adjustment of something somewhere.

Yeah - The main adjustment being nuking the bot-net into so much 
glow-in-the-dark slag.

Lotsa luck with that, though...

> 
> I just ran tcpdump here for approximately a half-hour.
> I filtered out anything sourced on our LAN, so it was
> only incoming.
> 
> 407 items.
> 164 were nntp
> 140 were pop3
> 104 were ??? not IP, probably arp, len 52
> (Can't tell because I used awk to only catch size, src/port, dest/port)

Yeah, bet on those len 52 packets being either ARP or DHCP traffic.

-- 
Don Bruder - dakidd@sonic.net - If your "From:" address isn't on my whitelist,
or the subject of the message doesn't contain the exact text "PopperAndShadow"
somewhere, any message sent to this address will go in the garbage without my
ever knowing it arrived. Sorry... <http://www.sonic.net/~dakidd> for more info

In article <siegman-E4BA74.10091903082008@news.stanford.edu>,
 AES <siegman@stanford.edu> wrote:

> I just started up NT-NewsWatcher on my Airport+DSL-connected MacBook a 
> few moments ago, noticed that the "?"'s in front of the 26 groups in my 
> Subscribed Groups window were only very slowly turning into numbers of 
> new messages, but also observed that the activity light on my DSL modem 
> was flashing like mad. 
> 
> So, I started up Activity Monitor (which I don't normally keep running), 
> and selected the Network Tab.  The  text at the bottom of AM's window is 
> showing "Data Received: 93 MB" and climbing steadily; the green line in 
> the little window to the right of that is pegged at the top of the 
> window and the text says "Data received/sec" is about 40 kB (which might 
> be about right for our very marginal DSL connection).
> 
> So, how can I tell _where_ this data is going on my HD, or who's sending 
> it to me?
> 
> And, I started up Activity Monitor cold, and the 93+ MB can't possibly 
> have come in since I started it.  From what starting point does Activity 
> Monitor measure Data Received? -- and does it somehow keep track even 
> when it's not Open?
> 
> [In the time it took to compose this msg, the Data Received has climbed 
> to 120 MB . .. ]

Try running tcpdump with ASCII output:
  tcpdump -n -s0 -Xx


It could be a broken news server.  For example, this Highwinds dump I'm 
on now doesn't support XOVER.  Instead of returning an error, it stalls 
for a bit then replies that nothing is found.  Doing that for 1000 
articles results in a lot of time and bandwidth wasted on nothing.  The 
server also tends to reply in very small packets that aren't efficient.

Distributed news servers used for large ISPs can have high latency 
because they're passing along some of your requests to other news 
servers.

-- 
Google is a pro-spamming service.  I will not see your reply if you use Google.

In article <_rydnY1XH8vIYQjVnZ2dnUVZ_u2dnZ2d@comcast.com>,
 Don Bruder <dakidd@sonic.net> wrote:

> And then, there's the strangeness that these emails are being shipped to 
> the iCal port. Wazzup with that? :)

Is it possible that a port scan found that port open and tried it just 
in case a mail server was there?

-- 
Paul Sture

In <%golk.104$ZV1.97@trnddc07>, Wes Groleau wrote:

> I just ran tcpdump here for approximately a half-hour.
> I filtered out anything sourced on our LAN, so it was
> only incoming.
>
> 407 items.
> 164 were nntp
> 140 were pop3
> 104 were ??? not IP, probably arp, len 52
> (Can't tell because I used awk to only catch size, src/port, dest/port)

Looking at my perimeter firewall logs for August 3, I see 699 blocked 
attempts, mostly to high udp ports often used for IM and chat like things. 
Note that I don't even bother logging blocks to udp ports 137-143 
(netbios, and related Windows vulnerabilities) because my log files were 
getting to big.

On my external facing server, I have 311 failed ssh log in attempts for 
the same period.

These numbers seem a bit low than usual, but within the normal range.

Here is another thing you can try.  Unplug all of your machines from your 
router, but leave it connected to the net.  Every time you see the light 
flicker, it means that something is probing you.

-j

-- 
Jeffrey Goldberg                     http://www.goldmark.org/jeff/
  I rarely read top-posted, over-quoting or HTML postings.
  http://improve-usenet.org/

In article 
<alpine.OSX.1.10.0808031905350.36642@hagrid.ewd.goldmark.org>,
 Jeffrey Goldberg <nobody@goldmark.org> wrote:

> Here is another thing you can try.  Unplug all of your machines from your 
> router, but leave it connected to the net.  Every time you see the light 
> flicker, it means that something is probing you.

I did precisely that when I was installing from DVD recently, and saw 
the switch lights flickering every couple of minutes or less.

I should mention that my Tiger DVD contains 10.4.6, so I downloaded all 
the updates up to 10.4.11 (the current one), plus the latest 
(cumulative) security patch and pulled the cable before I started the 
installation. I did this to avoid exposing to the internet a system 
which wasn't up to date with the latest O/S level and patches.

-- 
Paul Sture

On Sun, 03 Aug 2008 10:09:40 -0700, AES <siegman@stanford.edu> wrote:

>So, how can I tell _where_ this data is going on my HD, or who's sending 
>it to me?

Don't you want to know where it's coming from?

Methinks some versions of the Airport support Syslog:
<http://docs.info.apple.com/article.html?artnum=107993>
Yep.  Just find a syslog monitor for your PC and it will bury you in
traffic and connection data.  (Sorry, no SNMP for Airports).

I'm not familiar with Mac traffic monitoring programs, but I would
suspect that some PC syslog monitors might be adaptable:
<http://www.sonic.net/wallwatcher/>


-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558

In article <q4ce945hra7an1tdpgbthhbhmp8qa8hbus@4ax.com>,
 Jeff Liebermann <jeffl@cruzio.com> wrote:

> On Sun, 03 Aug 2008 10:09:40 -0700, AES <siegman@stanford.edu> wrote:
> 
> >So, how can I tell _where_ this data is going on my HD, or who's sending 
> >it to me?
> 
> Don't you want to know where it's coming from?
> 
> Methinks some versions of the Airport support Syslog:
> <http://docs.info.apple.com/article.html?artnum=107993>
> Yep.  Just find a syslog monitor for your PC and it will bury you in
> traffic and connection data.  (Sorry, no SNMP for Airports).

Au contraire.  See Airport Utility->Advanced-> Logging and SNMP.
> 
> I'm not familiar with Mac traffic monitoring programs, but I would
> suspect that some PC syslog monitors might be adaptable:
> <http://www.sonic.net/wallwatcher/>

-- 
Tom Stiller

PGP fingerprint =  5108 DDB2 9761 EDE5 E7E3  7BDA 71ED 6496 99C0 C7CF

On Mon, 04 Aug 2008 17:07:06 GMT, Tom Stiller <tomstiller@yahoo.com>
wrote:

>> Methinks some versions of the Airport support Syslog:
>> <http://docs.info.apple.com/article.html?artnum=107993>
>> Yep.  Just find a syslog monitor for your PC and it will bury you in
>> traffic and connection data.  (Sorry, no SNMP for Airports).
>
>Au contraire.  See Airport Utility->Advanced-> Logging and SNMP.

Oops and thanks.  I don't do much with Mac's and Airports and never
noticed.  

Here's the associated MIB file:
<http://docs.info.apple.com/article.html?artnum=120227>
Any SNMP based monitoring program or MIB browser should work to get
traffic and connection data out of the router.  That will tell where
the traffic is coming from, but will not show much about content or
where it's landing on the hard disk.  Identifying the source is often
useful for identifying the content.



-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558

AES wrote:
> ...
> So, how can I tell _where_ this data is going on my HD, or who's sending 
> it to me?  ...

Since it hasn't been mentioned yet, you might look at the 'lsof'
command.  I think it is a standard command line tool in OS X which
lists open files (which includes devices, etc, since everything is
file in Unix...) Honestly, I'm not that handy with this command so
you may have to do some digging in all the cruft which is returned
and read the man page to narrow things down to what is sensible
for your search.   For example,  lsof -p 12345  lists files open
by that process.  You may need to run it as root to get the whole
picture.

http://www.macosxhints.com/article.php?story=20040121001144687
and other fine Google hits for [lsof mac].
-- 
Clem
"If you push something hard enough, it will fall over."
              - Fudd's first law of opposition

http://www.google.com/search?hl=en&q=apostrophe

In article <g7d2s7$4r5$1@aioe.org>, "Jamie" <darkshad@darkshado.ca> 
wrote:

> http://www.google.com/search?hl=en&q=apostrophe

Sorry, I see the link, don't get the message.  Did I fail to 
apostrophize Where's in the original post, or are you saying it 
shouldn't be there?

On Wed, 06 Aug 2008 14:47:51 -0700, AES <siegman@stanford.edu> wrote:

>In article <g7d2s7$4r5$1@aioe.org>, "Jamie" <darkshad@darkshado.ca> 
>wrote:
>
>> http://www.google.com/search?hl=en&q=apostrophe
>
>Sorry, I see the link, don't get the message.  Did I fail to 
>apostrophize Where's in the original post, or are you saying it 
>shouldn't be there?

It was my use of "Mac's" in my posting that's incorrect.  I don't like
to read my own postings, so I didn't catch the mistake.

I should be more careful when posting to Mac newsgroups.  The
copyright, apostrophe, and political correctness vigilance enforcers
are everywhere, insuring that all things Apple remain perfectly
correct.

Hmmm...  From Apple, shouldn't it be iPostrophe?

-- 
Jeff Liebermann     jeffl@cruzio.com
150 Felker St #D    http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann     AE6KS    831-336-2558

In article <michelle-9BE9B8.15152206082008@news.east.cox.net>,
 Michelle Steiner <michelle@michelle.org> wrote:

> In article <6c7k94do50lln289lpfk2v62sen3oukaol@4ax.com>,
>  Jeff Liebermann <jeffl@cruzio.com> wrote:
> 
> > I should be more careful when posting to Mac newsgroups.  The 
> > copyright, apostrophe, and political correctness vigilance enforcers 
> > are everywhere, insuring that all things Apple remain perfectly 
> > correct.
> 
> Ensuring.

Wicked!

And the "grocer's apostrophe" that Jeff seems to have used is a common 
grammar error, not unique to Macs (or MACs, for that matter).

Steve

-- 
steve <at> w0x0f <dot> com
"Life should not be a journey to the grave with the intention of
arriving safely in an attractive and well preserved body, but rather to
skid in sideways, chocolate in one hand, chip shot in the other, body thoroughly
used up, totally worn out and screaming "WOO HOO what a ride!"