[tadd]

I have several Macs on line at the house all the time. My wife and kid and I have separate machines.
A few days ago, about the same time we finished upgrading them all to Lion, my VOIP phone started having drop-out problems. People we called complained that we were breaking up.
I started Activity Monitor on all three machines and discovered that each Macs was busily sending. I quit all applications and after some spikes it settled down, still with lots of outbound traffic. NETSTAT showed many open connections, even when all user-started applications had been quit. The total bandwidth between the bunch of machines was hundreds of kbits/second.
I started looking at netstat and doing reverse lookups and found that each machine made several connections to apple engineering, to akamai, and to a few other sites that I can only see are from UNITED STATES. This doesn't limit it much.
Is this normal? I took to blocking any listed IP address at my router and that knocked the traffic volume down by quite a bit. So far I haven't seen any negative effects on internet behavior but I've only been playing with this for a couple of hours.
Could I finally have met a MacOS SpamBot? Is this Apple on purpose?

I have a NetGear router to a Time Warner cable modem. According to the router my outbound traffic for the last 26 hours is 2511MB and my incoming is 1512MB.
That's ridiculous. 2GB outbound in 26 hours?
Another screen on the router shows that outgoing traffic MB per day is
7MB for email
1886MB for HTTP
and 611MB for Others

The only non-Apple program we use that connects to the Internet as a primary function is FireFox.
We're all using MacOS Lion, 10.7.1 or 10.7.0 and all on Intel 64 bit machines.

[besson3c]

Are there any unusual processes running?

[Waragainstsleep]

Well Apple engineering and Akamai will both be Apples doing, not a spambot. I wonder what Lion is up to.

[tadd]

I took two screenshots of Activity Monitor to capture all of the processes. You can see the packet rate down at the bottom. 621 per second? Then I grabbed the text from netstat - n. They are in a zip file on my idisk public directory.
http://public.me.com/tadd/screenies_and_netstat.zip. The password on my public is macnnforum.

Thanks for your time!

Tadd

[chabig]

I see you're running RealPlayer. That's got to be old and obsolete, and may account for continuous data transfer.

[tadd]

72.14.204.155 resolves to
"iad04s01-in-f155.1e100.net"
Top Level Domain: "1e100.net"
Country IP Address: UNITED STATES

[besson3c]

What is 1e100.net? - Google Help

[tadd]

I don't understand why my Mac is sending 1.4K/second to Google when i don't even have a web browser running.
We've taken to unplugging our Macs when not using them else our vonage boxes don't work.

[tadd]

2K per second -- don't know who they are

IP Information - 64.236.144.228

IP address: 64.236.144.228
Reverse DNS: [Timeout]
Reverse DNS authenticity: [Unknown]
ASN: 1668
ASN Name: AOL-ATDN
IP range connectivity: 6
Registrar (per ASN): ARIN
Country (per IP registrar): US [United States]
Country Currency: USD [United States Dollars]
Country IP Range: 64.236.0.0 to 64.236.255.255
Country fraud profile: Normal
City (per outside source): Unknown
Country (per outside source): US [United States]
Private (internal) IP? No
IP address registrar: whois.arin.net
Known Proxy? No
Link for WHOIS: 64.236.144.228

[Thorzdad]

64.236.144.228 belongs to the AOL Transit Data Network
Do you use iChat?

[tadd]

I frequently use iChat, yes, but when I noticed that link I had not had iChat or any other IM running since last recover-from-sleep-with-password. What I'm worried about at this point isn't so much that hackers are into my system. I'm really worried that the more visible companies, like AOL, Google, Akamai, Apple, Microsoft, are feeling free to have my computers generate outgoing traffic which is not in my interest. That is, they are using a resource that I am subscribing to (my Internet connection) to transmit data which is not transmitted to fulfill my needs, and possibly not respecting my privacy. This has already caused me inconvenience because that outgoing traffic is competing for outbound bandwidth with applications I am using on purpose, like VOIP. I would be really really depressed if my Internet provider decided to restrict my service, or charge me extra, because somebody was using me as a Torrent server without my consent like Akamai appears do.

This feels very much like my DVD player refusing to skip past a preview because a machine I PAID FOR, is choosing to act against my interest and is instead representing the interests of a studio that pressed the DVD which I also paid for.

In the case of the DVD, I can almost understand. After all they are unlikely to make movies for my enjoyment if they can't make a profit, and they are using every angle they can get their hands on to out-compete with the other-guys.

In the case of my computer sending data without my consent and against my interest... I'd like an opt out. Unlike the DVD player which is performing an act I can completely see and comprehend, my computer is taking action which I am not expected to see at all, and am completely unable to diagnose or comprehend. What is AOL doing sucking thousands of bytes per second from my computer? What are those bytes? Where do they come from? What will they be used for?

If I block the traffic Apple is sending, my email stops working, the App Store, which is now the sole provider of a large chunk of the applications that run on the Mac, stops working. If I block the traffic Google is sending, a quarter of the web sites on the Internet take minutes extra to load, not to mention Google maps, Gmail, and etc. which are completely broken.

My wife's computer seems to always be sending data at a rate of 1 to 2 kbytes/second.

I've taken to walking past her machine and yanking the ethernet cable on it for a few seconds, which seems to stop it. Her computer is definitely doing this more often than mine. I suspect she's got things going on that I don't know about. My ability to spot required vs optional vs 3rd party applications on the task list is not as good as many, but I suspect I'm quite a bit better than most Mac owners.

What I'd like is an internet registry where one can go look for what applications use what sites and what a user should expect with regards to regular bandwidth use.
It would also be nice to have a driver or hardware device which can throttle outbound traffic.

[tadd]

Whatever is going on with my wife's iMac keeps it from going to sleep.

Bizarrely the iMac has no light to tell you if it is in sleep or not. I added an optical mouse to the computer now to let me see when the machine sleeps.

I start the computer from power down and log in. There is no outgoing traffic.

I set the Energy control panel to turn off the monitor and put the machine to sleep, both at 1 minute. I started and quit a NetFlix movie on Safari, iChat, email, the App store. I then quit everything except activity monitor. Now I let it sit for a minute. The monitor goes off but after 2 minutes the LED on the mouse is still on. I logged her off and back in and tried again. Optical mouse stays on.

If I log off and click Sleep,, it turns off the optical mouse.
If I let the machine go to sleep on its own after logging off, it turns off the optical mouse.


I have a few more tests.
Start the iMac from off, log-in, don't start anything. Wait for a minute and see if it sleeps.
Create a new log-in account and see how it behaves.
This will have to wait until after I get some more time.

My Mac Pro seems to have this problem less frequently but I'm not as much of a web surfer I think.