[mbrando]

Hi,

I'm running NetStat from iSlaver.net to view netstat's in my dock. I noticed that there are http connections to some IP's and dmains even when Mail and all browsers are closed. If I run net sata in a terminal window I see things like this:

tcp4 0 0 192.168.1.101.49210 pass12.dizinc.co.http ESTABLISHED
tcp4 0 0 192.168.1.101.49209 pass12.dizinc.co.http ESTABLISHED

tcp4 0 0 192.168.1.101.49228 pass12.dizinc.co.http ESTABLISHED
tcp4 0 0 192.168.1.101.49227 pass12.dizinc.co.http ESTABLISHED

tcp4 0 0 192.168.1.101.49255 wu.apple.com.http SYN_SENT

I also see the same traffice for the follow IP's

66.195.127.199

12.130.50.206

12.120.5.14

Anyone know why someone wants to connect to my Mac on ports over 49000? Maybe spyware?

Thanks,
Mike

[mbrando]

Hi,

It turns out that the TCP traffic I was reading in netstat was from widgets in my dashboard. I MacNN user suggested running this command in the terminal window:

lsof | grep -i TCP

It will tell which applications are using TCP. That is active TCP connections. To further clarify, These dashboard apps were using http to connect to an outside source and then communicating with my Mac on ports in the 49000 to 50500 range.

sincerely,
Mike