I was watching Little Snitch for another process, and noticed df
was making requests to various servers. I thought df
was only for checking free disk space locally, but it appears to be doing more than just that.
It calls out to a number of servers (current count is 38 different servers) and sends a few bytes each time. Subset of servers include:
talk.google.com
safebrowsing-cache.google.com
jsfiddle.net
cdn2.sbnation.com
urs.microsoft.com.nsatc.net
api.facebook.com
It seems like some kind of tracker, and it certainly doesn't seem like the behavior I'd expect from df. It's located in /bin/df
, and run by root
.
Any ideas? Normal behavior and I'm just paranoid?
I've tried blocking it with Little Snitch rules, but it seems to ignore them.
df
? And are you sure it's the realdf
? Try running/bin/df
to be sure