Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was watching Little Snitch for another process, and noticed df was making requests to various servers. I thought df was only for checking free disk space locally, but it appears to be doing more than just that.

It calls out to a number of servers (current count is 38 different servers) and sends a few bytes each time. Subset of servers include:


It seems like some kind of tracker, and it certainly doesn't seem like the behavior I'd expect from df. It's located in /bin/df, and run by root.

Any ideas? Normal behavior and I'm just paranoid?

I've tried blocking it with Little Snitch rules, but it seems to ignore them.

share|improve this question
I can't reproduce this. Which options did you use for df? And are you sure it's the real df? Try running /bin/df to be sure – patrix Mar 6 '13 at 18:45
/bin/df runs as normal, as far as I can tell. I don't use it at all in my day-to-day work, so it was odd to see it listed in the Little Snitch "Network Monitor". – Carl Mar 6 '13 at 18:52
And like I said, it "calls out" to these servers once every few seconds. But it's not actively running when I grep through "ps -ax". So something else is calling "/bin/df" and it's sending data from it. That's all I can tell so far. Little Snitch claims that the app is run by root, and is located at "/bin/df". – Carl Mar 6 '13 at 18:53
As a precaution, and while I'm figuring this out, I renamed "/bin/df" to "/bin/not_df" and restarted my machine. So far it has not come back in the Network Monitor. I will keep investigating as I have time. – Carl Mar 6 '13 at 19:01
Have you mounted any network storage in some way? – Gerry Mar 6 '13 at 20:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.