0

Anyone used ipfw or pfctl to block an IP address range for outgoing packets?

I would like to temporarily block Apple's IP address range 17.*.*.* to find everything that's phoning home phoning home. Anyone know if Apple owns any other IP address ranges?

Improve this question
3
  • 1
    There's actually no "out" in ipfw. Technically, it's classified as "in" and "not-in." May be semantics, but there is a difference. I block traffic using inbound rules (e.g., to block FB, I use: deny ip from 69.171.224.0/19 to any in). If you're interested in isolated traffic, netstat is a better tool to look at. To my knowledge, Apple doesn't a) spy on their users, and b) they don't own the entire 17.0.0.0-17.255.255.255 block.
    – user10355
    Commented Dec 18, 2011 at 21:19
  • 1
    I might be wrong cksum, but I am pretty sure they DO actually own the entire 17 class A ip address range.
    – ConstantineK
    Commented Dec 18, 2011 at 21:52
  • 1
    Apple does indeed own 17.everything, so you could use a rule like deny ip from any to 17.0.0.0/8 to block all traffic to that. However, that's not the only address range that Apple uses. You might think about blocking apple.com at the DNS level instead/also.
    – Gordon Davisson
    Commented Dec 18, 2011 at 22:52

1 Answer 1

Reset to default
2

I highly recommend Little Snitch. Although it doesn't do anything you couldn't do with free tools, it makes monitoring, configuring, and blocking your system's outgoing traffic on a per-application basis ridiculously easy.

I'm a programmer, and one of those guys who always has a Terminal window open, and yet I still prefer using Little Snitch for this task.

It's not free, but it is cheap. And the free trial is fully functional - the only caveat is you have to manually restart it every 3 hours.

That would probably be all you need to open all your Apple-branded apps and verify whether or not they're phoning the mothership.

And if they are phoning any address outside the 17.x.x.x range, you'd learn that really quick.

Improve this answer
2
  • I would worry that a closed source tool like Little Snitch already ignores traffic it's authors deemed unimportant. I've used Little Snitch's free version for evaluating non-Apple software before though.
    – Jeff Burdges
    Commented Dec 19, 2011 at 1:51
  • 1
    +1 anyways, always good when people mention user friendly tools that help expose apps phoning home.
    – Jeff Burdges
    Commented Dec 19, 2011 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .