Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Anyone used ipfw or pfctl to block an IP address range for outgoing packets?

I would like to temporarily block Apple's IP address range 17.*.*.* to find everything that's phoning home phoning home. Anyone know if Apple owns any other IP address ranges?

share|improve this question
1  
There's actually no "out" in ipfw. Technically, it's classified as "in" and "not-in." May be semantics, but there is a difference. I block traffic using inbound rules (e.g., to block FB, I use: deny ip from 69.171.224.0/19 to any in). If you're interested in isolated traffic, netstat is a better tool to look at. To my knowledge, Apple doesn't a) spy on their users, and b) they don't own the entire 17.0.0.0-17.255.255.255 block. –  cksum Dec 18 '11 at 21:19
1  
I might be wrong cksum, but I am pretty sure they DO actually own the entire 17 class A ip address range. –  hobs Dec 18 '11 at 21:52
1  
Apple does indeed own 17.everything, so you could use a rule like deny ip from any to 17.0.0.0/8 to block all traffic to that. However, that's not the only address range that Apple uses. You might think about blocking apple.com at the DNS level instead/also. –  Gordon Davisson Dec 18 '11 at 22:52

1 Answer 1

I highly recommend Little Snitch. Although it doesn't do anything you couldn't do with free tools, it makes monitoring, configuring, and blocking your system's outgoing traffic on a per-application basis ridiculously easy.

I'm a programmer, and one of those guys who always has a Terminal window open, and yet I still prefer using Little Snitch for this task.

It's not free, but it is cheap. And the free trial is fully functional - the only caveat is you have to manually restart it every 3 hours.

That would probably be all you need to open all your Apple-branded apps and verify whether or not they're phoning the mothership.

And if they are phoning any address outside the 17.x.x.x range, you'd learn that really quick.

share|improve this answer
    
I would worry that a closed source tool like Little Snitch already ignores traffic it's authors deemed unimportant. I've used Little Snitch's free version for evaluating non-Apple software before though. –  Jeff Burdges Dec 19 '11 at 1:51
1  
+1 anyways, always good when people mention user friendly tools that help expose apps phoning home. –  Jeff Burdges Dec 19 '11 at 1:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.