Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I was watching Little Snitch for another process, and noticed df was making requests to various servers. I thought df was only for checking free disk space locally, but it appears to be doing more than just that.

It calls out to a number of servers (current count is 38 different servers) and sends a few bytes each time. Subset of servers include:

  • talk.google.com
  • safebrowsing-cache.google.com
  • jsfiddle.net
  • cdn2.sbnation.com
  • urs.microsoft.com.nsatc.net
  • api.facebook.com

It seems like some kind of tracker, and it certainly doesn't seem like the behavior I'd expect from df. It's located in /bin/df, and run by root.

Any ideas? Normal behavior and I'm just paranoid?

I've tried blocking it with Little Snitch rules, but it seems to ignore them.

share|improve this question
1  
I can't reproduce this. Which options did you use for df? And are you sure it's the real df? Try running /bin/df to be sure –  patrix Mar 6 '13 at 18:45
    
/bin/df runs as normal, as far as I can tell. I don't use it at all in my day-to-day work, so it was odd to see it listed in the Little Snitch "Network Monitor". –  Carl Mar 6 '13 at 18:52
    
And like I said, it "calls out" to these servers once every few seconds. But it's not actively running when I grep through "ps -ax". So something else is calling "/bin/df" and it's sending data from it. That's all I can tell so far. Little Snitch claims that the app is run by root, and is located at "/bin/df". –  Carl Mar 6 '13 at 18:53
    
As a precaution, and while I'm figuring this out, I renamed "/bin/df" to "/bin/not_df" and restarted my machine. So far it has not come back in the Network Monitor. I will keep investigating as I have time. –  Carl Mar 6 '13 at 19:01
2  
Have you mounted any network storage in some way? –  Gerry Mar 6 '13 at 20:59
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.