Please don't give me a suggestion that you haven't tried and approved yourself. Also please feel free so skip and not read anything below. I trust the title is already summing up pretty good.

What I've got

Strong passwords, updated system, some log monitoring with Who Is Connected and nothing else. Just the passwords and updates have been enough until now. But that's probably only because I have no presence online, random IP and, on the wifi side, I'm in a spot that not many people get close enough to get the signal. Which makes this a good sandbox environment.

I've tried about all tools listed in links from this question, and they're either not working, too complicated or have some bug.

What I'm looking for

What you say? What are the simplest things that can be done on the mac to keep it stable, open and free within an open wireless network (and the already open internet)? That is, other than buying the fonera, which I'm waiting to arrive back from warranty - I want to know only mac-wise.

Adding to that, I'd want the same thing when connected to any other network. But I believe that's nearly irrelevant as I don't care if data is being spoofed. I'm not trying to secure any data out of my machine / network.

And yes, the question is a bit misleading on purpose. I do ultimately want to secure my whole home network, but I also know it can only be done starting on the router and applying strong policies in every machine within it.

For Instance

Just the other day I've realized my mac is constantly being attacked over the web through SSH - and looks like there's nothing I can do fast enough to prevent a big harm in case someone could break in. I can barely knows if someone brute forced my password, even while highly unlikely, and does nothing else after that for whatever reason.

So, in this instance, I'd like to be able to first block the attacker with some smart firewall rules, then to send back a message "I'm watching you" or anything like this, just to intimidate. It could also be changing any welcome message specifically to the attacker. Changing SSH port is the most suggested measure, but I'd really want to avoid doing that.

There's another instance where the attack were through AFP, which I also want to leave open. Someone added a "Pamela" folder to my dropbox, which is perfectly fine. But if I don't go there and see it's there, I don't get any notification about it and don't get to see who did it and when. Ideally I would see the exact moment and even get to interact with the user somehow.

Summing up

The solution would probably be enough if it were one software able to: get me notified of any user connection anywhere (but just once per user / attack / minute or something), take a preventive automatic measure, give an automatic response and give me options to take action if needed.


Sorry for such a big and long question!

  • So, (if I understood correctly), wouldn't something like Little Snitch do the work for you?
    – nuc
    Apr 2, 2011 at 22:47
  • 1
    @nuc LS monitors apps on your computer using the Internet. He's interested in other computers using his network. Apr 2, 2011 at 23:18
  • 1
    hm, then something like Mocha ?
    – nuc
    Apr 2, 2011 at 23:34
  • 1
    I think you're going about this the wrong way. If you're actually interested in security, you set your router to block everything incoming except your VPN. Then using OpenVPN or Hamachi or whatever, you let yourself inside. Much simpler, and simpler is usually more secure.
    – user4952
    Apr 3, 2011 at 3:35
  • 1
    Oh, and I don't know how you expect to send a message back to the attacker. They just have some scripts running and aren't going to have their own ports open for you to connect back into.
    – user4952
    Apr 3, 2011 at 3:36

2 Answers 2



Mocha is a tool that monitors your network activity and keeps a record of Ip / Mac address pairings and firewall logs. It will give a warning when it notices any suspicious activity, like any changes in Mac address or any connection attempt to the firewall.

I hope that helps! :)

  • I loved the description but still couldn't make much use of the app: It looks like it only works while it's open, rather than running in the background and it has no continuity, i.e., the next time I open it it lost its configuration and logs. The warning seems to appear way too much thus giving false positives. But I'm still studying it as I may just be using it wrong or have to customize it more.
    – cregox
    Apr 4, 2011 at 17:55
  • Even if it does everything it says, I will still be missing a way to automatically counter attack (such as simply being able to run a script given a specific pattern is found). Still, sounds great nevertheless and if I can make it run as good as it's described it should, I'll accept this until something better comes along! :)
    – cregox
    Apr 4, 2011 at 17:57

Change your SSH port to a different one than the default 22. Security by obscurity is generally a bad thing to solely depend on but you'll get a good ROI for this tactic in the way of less attacks for sure.

  • Thanks for the suggestion! But not looking for the trivial way to do "security" here. ;)
    – cregox
    Apr 3, 2011 at 16:03
  • 1
    Thing is, most of the "attacks" you're seeing are trivial, automated, script-kiddie attempts. By the time ANY machine has been on the internet for more than a couple minutes it has started receiving automated "doorknob-rattling" attempts. As you've seen, the base OS is sufficient to rebuff those.
    – Dan Ray
    Apr 4, 2011 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .