5

In general I have incoming connections disabled by my security software (Little Snitch). But even when I do this, on public wifi, I see numerous incoming connections for netbios and mDNSResponder allowed automatically.

For example, at a recent hotel stay, I was confronted with a long list as soon as a logged on to the wifi there (listed as automatically allowed by Little Snitch)

enter image description here

which quickly grew to the thousands

enter image description here

What are these incoming connections for? Why are they being automatically allowed? Are they a security threat?


Note that if I explicitly block all of these connections using Little Snitch, my network access fails, but the network still seems to function when I alternatively block incoming connections using Apple's (OS X 10.9) firewall

enter image description here

and enable stealth mode

enter image description here

  • As far as I know netbios and mDNSresponder are system services that, among other things, gather information on who else is on the network such that services like file and printer sharing can work. The connections are not harmful (as far as I know). I'm not sure why Little Snitch allows them by default. – Saaru Lindestøkke Dec 14 '13 at 20:33
2

netbios

You could block the netbios connections with Little Snitch. These connections are connections attempt most usually coming from Windows sharing the same Wi-Fi network and testing which share and printers are available on your computer. This protocol behaves like a guy entering a new building and testing all door knobs, when the door opens he asks: What's your name? What do you share? Do you print? This protocol is stupid, and dangerous, but most notably for Windows. This protocol is the leading vector of malware broadcast inside LAN of companies using Windows since more than 20 years (toward the floppies era). This protocol is responsible of the largest security damages within big companies.

netbios is a security threat.

On all my Mac I tear off this service (netbiosd), during the post installation procedure (see: …to disable WINS in Network settings, working on 10.7, 10.8, 10.9).

mDNSResponder

You couldn't and shouldn't block the mDNSResponder because you would break the normal working of the DNS on your Mac. I.e. you won't be able to find the IP address of www.microsoft.com.

mDNSREsponder isn't a security threat (today).

Firewall setting

Your method to block connection through the MacOS X firewall is the correct and safe one within any aggresive environment.

  • 2
    Can you describe how to "tear off" netbiosd ? – orome Feb 2 '14 at 17:55
  • Why would turning off mDNS break regular DNS? Now, it'll definitely break local hostname resolution, you won't be able to automagically see other machines on the same network. But wouldn't it find outside servers just fine? – SilverWolf Dec 4 '18 at 23:44
0

I'm not sure how comfortable you are with the command line, but here goes. netstat is a command which shows (among other things) the ports that are open. So first I open Terminal (in Applications/Utilities) and then netstat to can see a list of established connections (22 in my case). It tries to resolve the local and foreign addresses, so here I can see the browser connections to stackoverflow.com:

vger.local:~(14)+>- /usr/sbin/netstat -a | fgrep stackoverflow
tcp4       0      0  10.1.1.80.57905        stackoverflow.co.http  ESTABLISHED
tcp4       0      0  10.1.1.80.57891        stackoverflow.co.http  ESTABLISHED
tcp4       0      0  10.1.1.80.52015        stackoverflow.co.http  ESTABLISHED
vger.local:~(15)+>- 

(fgrep is used here to filter the output to just those lines containing the string I am searching for.) The 10.1.1.80 is the IP of my desktop and the number after it is the TCP port. So now I can use lsof to see what program has that port open:

vger.local:~(15)+>- /usr/sbin/lsof -i TCP:52015
COMMAND PID    USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
firefox 631 pkearns   64u  IPv4 0x552e1c664da13fcb      0t0  TCP 10.1.1.80:52015->stackoverflow.com:http (ESTABLISHED)
vger.local:~(16)+>-

Firefox, no surprises there. If you have the numbers of the ports (connections) being held open then you can use lsof to see what process/programme is holding them open.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .