[rotuts]

Im on 10.9.x, and use little snitch to block google's constant nipping etc

now 'netbiosd' comes up from time to time and Id like to know what it is

I did look into it, with a voluntary google search and it some sort of network thing-y ?

Im not on a network, just me and my iMac. no wifi, nada.

what gives ?

many thanks

[besson3c]

Netbiosd allows you to share drives with Windows machines on your network, and if you are on the internet you are on a network.

[rotuts]

thanks

ill give them a Neyt-ski

[Mike Wuerthele]

Remember you've done this, though. There may come a day where you want to share a Windows folder - you'll have to unblock to do so.

[rotuts]

OK thanks !

[turtle777]

I'm not sure using Little a Snitch to block this is a good idea.
Netbiosd is a part of OS X, and you're blocking OS X from normal operation.

If you don't want to connect to other machines / network locations, turn off Sharing in System Preferences.

-t

[besson3c]

Sharing in system prefs controls inbound connections. Netbiosd helps outbound connections, I think.

That being said, I think it is important to understand what you hope to accomplish running software like Little Snitch. It has absolutely no bearing on web browsing or anything provided by Google except for perhaps the Google Drive desktop client.

[rotuts]

OK Ill change that

Ive been getting a 'start error' which I cant remember what it was

Ill OK netbios this never seemed to be someting in 10.6.x

I just like to understand whats connection to m,y comouter. and google fiddling and faddling w/o permission is annoying to me

[Mike Wuerthele]

That's not Google, though.

I get your meaning.

[rotuts]

so I allowed Netbiosd to connect via the internetconnection

I thought this was done. I do not share window docs, ever

now I get 1 - 2 more netbiosd requests every day

to a different IP
why is this ? why so many IP's ?

ive never shared windows docs ever

Im not really paranoid, but I must tell you Google which I block unsolicited

'requests' is moving me in that direction

so what does netbiosd really want ?

they never bothered me on 10.6.x

[turtle777]

What makes you think Google is responsible ?

-t

[rotuts]

sorry I dont blame google. I have issues w google but

why does netbios keep asking to connect to different IP addresses

i dont share via the internet are these ip addresses trying to connect to me for some obscure reason ?

[ghporter]

What are those other IP addresses? Have you looked them up to see where they go?

[rotuts]

good idea Ill try that. still ... what or who wants to go there in a general sense

i certainly dont

Ill see


I assume I post the address in the browser ?

thanks

[rotuts]

I looked up a few and didnt get very far

China, and the Ukraine ?

175.166.206.132

223.167.14.107

176.103.49.29

216.218.206.79

any ideas ?

[rotuts]

I deleted them all and wont accept any more

still what's going on ?

[besson3c]

Windows file sharing requires being on your LAN, so those foreign IP addresses have nothing to do with netbiosd. Doesn't Little Snitch report on what ports are being requested by these IP addresses? Is this incoming or outgoing traffic?

I suggest taking a different approach here. It seems like you are fixating, and fixating on things that might not be relevant. Instead of finding something else and fixating, take a step back.

What problems are you having? What makes you convinced you are having problems? Is this rationale sound? What evidence do you have? Have you tried Googling an error message or some piece of that evidence?

If you are receiving inbound requests from those IP addresses, it sounds like you are directly connected to the internet and not behind a router/firewall that would block those requests? If they are outbound requests, it sounds like you have some malware installed, and this is worth fixating on, not netbiosd.

[rotuts]

my firewall in syspref is on. i have not gone into firewall options.

''so those foreign IP addresses have nothing to do with netbiosd''

the address's are the ones netbios wants to connect to. Ive deleted them but should they come back ill try and figure out inbound vs outbound through little snitch is the only way Ive ever heard of netbios.

im always directly connected to the internet w Firewall On. i have no router.

the iMac is brand new ( in use a week or so ) in OS 10.6.x i also had LIittleSnich and never got a netbios

request. I appreciate your pointers

how might I look for malware ?

the problem is that netbios requests are new to me, and i dont and never have shared file over the internet.

id appreciate any help re a malware hunt.

thanks

[besson3c]

Get a router. Being directly exposed to the internet is not a good idea. Even servers are put behind switches, firewall/router/gateway VMs are used, etc. Don't you have a smart phone or some device that needs Wifi?

Just "turning on" a firewall is insufficient, your firewall is only as good as your firewall rules, and it sounds like your rules are not set correctly since your firewall is not blocking these requests. By getting a router all requests will be blocked, the only ones that will be able to get through to you are the ones you forward to individual machines in your network (i.e. an explicitly set configuration). There will be no restrictions on your outbound connections, but if you are exposed to the internet there is a good chance these are inbound connection attempts.

What web browser do you use? Have you checked to see what extensions are installed? Rogue extension/plugins seem to be a popular way to obtain malware these days.

[rotuts]

I do have a router, it came with my veerizon FiOS service I used it for a bit, but only have one computer

it broke, so i went w/o with the new renewal verizon sent me another one : its a verizon actiontec.

I use safari and firefox nope no smartphone, no wifi. I just dont need them i have a flip phone for emergencies.

"" it sounds like your rules are not set correctly since your firewall is not blocking these requests. By getting a router all requests will be blocked, the only ones that will be able to get through to you are the ones you forward to individual machines in your network (i.e. an explicitly set configuration). """

how hard are these to 'set-up' so that i get the requests i want

Ill look into it. and thanks for pointing that out

Im not a computer dolt, I just have less and less interet in fiddling and faddling which is the past

was a lot of "fun"

thank God for MacNN and Little Snitch !

[besson3c]

You can buy a wireless router for around $50-100, it doesn't have to be issued by your ISP.

Check Safari and Firefox to see what extensions you have installed. Do these problems occur in both browsers? Do these problems occur with Little Snitch disabled?

Just get a router, or else review your OS X and Little Snitch firewall settings.

[rotuts]

Ill use the actiontec.

the only add- ons in both browsers is AddBlock+

im a bit unsure what you mean by " problems " everything is working fine as far as i can tell.

"" or else review your OS X and Little Snitch firewall settings ""

Im looking into this this way for now until I brush up on firewalls.

clearly something is happening w neetbios thats not about file sharing. Ill ignore all of these.

if little snitch lets me kknow something is trying to connect, I look into this as best as i can.

I so appreciate your help

any 'safe' reliable malware / adware software I can look over ?

again much thanks your way

[besson3c]

The bottom line: if Little Snitch is asking you about incoming connections, your firewall is not doing its job. The OS X firewall is application based, not port based, so you might have an application (or Malware) open that is listening for connections. If Little Snitch is asking about outbound connections to these sorts of IPs, you most definitely have malware installed.

Have you tried running a ClamXAV scan?

[besson3c]

The bottom line part 2: hardware routers/switches are good, and preferable to relying on software which can be misconfigured. It is harder to misconfigure a router.

[rotuts]

thanks many much

Ive DL'd ClamXAV and let it up date the various items it wants.

I wont run it until I back up my 10.9.x as one should

i used to do this then , well ....

i have a USB3 HD storage item coming today that might allow me to

easily back up to a USB3 drive, and Ill try to figure out how 'clone'

my boot drive to that same external drive

then Ill look into setting up the router

backing up , and maybe even taking a peak at OS 10.10,

as long as I can go back etc

your help is greatly appreciated.

[donaldkepler]

Netbiosd stands for network basic input/output system. Basically, it is a communication protocol which the computers use to communicate with each other. It is installed in Mac OS X by default. It is a daemon which handles the NetBIOS service when connected with internet.

[rotuts]

so this is something that is possibly by hackers ?

Ive used little snitch since 10.6.x basically for google. netbiosd never came up than, just when I moved to

10.9.5 on a new iMac.

[P]

Not unless it was named to confuse. There is a real netbiosd in the OS. NetBIOS is real, although very old, networking protocol frequently used by Windows.

NetBIOS - Wikipedia, the free encyclopedia