[PowerBub]

well, lately i've been running Activity Monitor 24/7. I always monitor the network usage and always when I am not doing anything, it is around 0kb/sec in. Today, however, it is hovering around 1kb. I've checked all my programs, quit them, restarted, and more, and still this constant traffic. I downloaded "darkstat" to sniff packets and it has everything on these two ports:

139 netbios-ssn
445 microsoft-ds

funny thing is, i have the os x firewall on, so how are these getting through? I suspect maybe a windows computer on my segment of the network is spewing out virus-laden nonsense, and i want to block it! (especially since i am limited to 6GB incoming data per month from my company)

any ideas? my computer is plugged directly into the cable modem with no router or anything (please don't suggest 'buy a router' as a suggestion).

[mduell]

Your firewall stops them from getting any further into your system, but it can't stop them from going through your modem and into your network card (and a router won't help, your ISP would still know you received them).

1 KBps for 30 days is about 2.5GB... I'd ask your ISP to block or ignore traffic on 139 and 445 or find an ISP without such a low cap.

[PowerBub]

Originally Posted by mduell

Your firewall stops them from getting any further into your system, but it can't stop them from going through your modem and into your network card (and a router won't help, your ISP would still know you received them).

1 KBps for 30 days is about 2.5GB... I'd ask your ISP to block or ignore traffic on 139 and 445 or find an ISP without such a low cap.

good point about the firewall, i didn't think of that for some reason.

yeah the 6GB cap is annoying, but i'm living in Macedonia (in the Balkans), and here 6GB/month is as good as it gets. In fact, most people who have cable internet have only 500MB-2GB, but I splurged for the "power package."

But I will email them and tell them to block those ports, thanks for the advice.

[ghporter]

Off topic-reference PowerBub's sig:
<Texan?Lady, I've seen cows sicker 'n this git up 'n walk!</Texan>

On topic:
Netbios traffic on port 139 is for windows file and printer sharing. Port 445 traffic is Microsoft Directory Services traffic or more specifically "SMB over IP;" it's how Samba connects between MS and non-MS operating systems. In other words, these are relatively friendly packets, and packets that are at least recognized and sometimes welcome on OS X computers. Tell the firewall you don't want them and your computer will be fine. If they are indeed from a Windows computer near you on your ISP's network, they probably won't count against yoru data allocation. That data quota should only be what comes directly from the ISP.