2

I was watching Little Snitch for another process, and noticed df was making requests to various servers. I thought df was only for checking free disk space locally, but it appears to be doing more than just that.

It calls out to a number of servers (current count is 38 different servers) and sends a few bytes each time. Subset of servers include:

  • talk.google.com
  • safebrowsing-cache.google.com
  • jsfiddle.net
  • cdn2.sbnation.com
  • urs.microsoft.com.nsatc.net
  • api.facebook.com

It seems like some kind of tracker, and it certainly doesn't seem like the behavior I'd expect from df. It's located in /bin/df, and run by root.

Any ideas? Normal behavior and I'm just paranoid?

I've tried blocking it with Little Snitch rules, but it seems to ignore them.

Improve this question
14
  • 1
    I can't reproduce this. Which options did you use for df? And are you sure it's the real df? Try running /bin/df to be sure
    – nohillside ♦
    Mar 6, 2013 at 18:45
  • /bin/df runs as normal, as far as I can tell. I don't use it at all in my day-to-day work, so it was odd to see it listed in the Little Snitch "Network Monitor".
    – Carl
    Mar 6, 2013 at 18:52
  • And like I said, it "calls out" to these servers once every few seconds. But it's not actively running when I grep through "ps -ax". So something else is calling "/bin/df" and it's sending data from it. That's all I can tell so far. Little Snitch claims that the app is run by root, and is located at "/bin/df".
    – Carl
    Mar 6, 2013 at 18:53
  • As a precaution, and while I'm figuring this out, I renamed "/bin/df" to "/bin/not_df" and restarted my machine. So far it has not come back in the Network Monitor. I will keep investigating as I have time.
    – Carl
    Mar 6, 2013 at 19:01
  • 2
    Have you mounted any network storage in some way?
    – Gerry
    Mar 6, 2013 at 20:59

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .