In general I have incoming connections disabled by my security software (Little Snitch). But even when I do this, on public wifi, I see numerous incoming connections for netbios and mDNSResponder allowed automatically.

For example, at a recent hotel stay, I was confronted with a long list as soon as a logged on to the wifi there (listed as automatically allowed by Little Snitch)

enter image description here

which quickly grew to the thousands

enter image description here

What are these incoming connections for? Why are they being automatically allowed? Are they a security threat?

Note that if I explicitly block all of these connections using Little Snitch, my network access fails, but the network still seems to function when I alternatively block incoming connections using Apple's (OS X 10.9) firewall

enter image description here

and enable stealth mode

enter image description here

  • As far as I know netbios and mDNSresponder are system services that, among other things, gather information on who else is on the network such that services like file and printer sharing can work. The connections are not harmful (as far as I know). I'm not sure why Little Snitch allows them by default. Dec 14, 2013 at 20:33

2 Answers 2



You could block the netbios connections with Little Snitch. These connections are connections attempt most usually coming from Windows sharing the same Wi-Fi network and testing which share and printers are available on your computer. This protocol behaves like a guy entering a new building and testing all door knobs, when the door opens he asks: What's your name? What do you share? Do you print? This protocol is stupid, and dangerous, but most notably for Windows. This protocol is the leading vector of malware broadcast inside LAN of companies using Windows since more than 20 years (toward the floppies era). This protocol is responsible of the largest security damages within big companies.

netbios is a security threat.

On all my Mac I tear off this service (netbiosd), during the post installation procedure (see: …to disable WINS in Network settings, working on 10.7, 10.8, 10.9).


You couldn't and shouldn't block the mDNSResponder because you would break the normal working of the DNS on your Mac. I.e. you won't be able to find the IP address of www.microsoft.com.

mDNSREsponder isn't a security threat (today).

Firewall setting

Your method to block connection through the MacOS X firewall is the correct and safe one within any aggresive environment.

  • 2
    Can you describe how to "tear off" netbiosd ?
    – orome
    Feb 2, 2014 at 17:55
  • Why would turning off mDNS break regular DNS? Now, it'll definitely break local hostname resolution, you won't be able to automagically see other machines on the same network. But wouldn't it find outside servers just fine?
    – SilverWolf
    Dec 4, 2018 at 23:44

I'm not sure how comfortable you are with the command line, but here goes. netstat is a command which shows (among other things) the ports that are open. So first I open Terminal (in Applications/Utilities) and then netstat to can see a list of established connections (22 in my case). It tries to resolve the local and foreign addresses, so here I can see the browser connections to stackoverflow.com:

vger.local:~(14)+>- /usr/sbin/netstat -a | fgrep stackoverflow
tcp4       0      0        stackoverflow.co.http  ESTABLISHED
tcp4       0      0        stackoverflow.co.http  ESTABLISHED
tcp4       0      0        stackoverflow.co.http  ESTABLISHED

(fgrep is used here to filter the output to just those lines containing the string I am searching for.) The is the IP of my desktop and the number after it is the TCP port. So now I can use lsof to see what program has that port open:

vger.local:~(15)+>- /usr/sbin/lsof -i TCP:52015
firefox 631 pkearns   64u  IPv4 0x552e1c664da13fcb      0t0  TCP>stackoverflow.com:http (ESTABLISHED)

Firefox, no surprises there. If you have the numbers of the ports (connections) being held open then you can use lsof to see what process/programme is holding them open.

  • This doesn’t seem to answer the question. The OP knows which local process is accepting a connection and wants to know why that connection is being made. This answer is describing how to go from a remote hostname to a local process name.
    – bdesham
    Feb 1, 2022 at 21:38
  • It wasn't intended to completely answer the 'why'; it was intended to help the investigation. So for example I saw heavy traffic on my Mac and suspected it was just updates. I used the method described above which showed it was the updater, which in that case answered the'why'. Feb 2, 2022 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .