0

Anyone used ipfw or pfctl to block an IP address range for outgoing packets?

I would like to temporarily block Apple's IP address range 17.*.*.* to find everything that's phoning home phoning home. Anyone know if Apple owns any other IP address ranges?

  • 1
    There's actually no "out" in ipfw. Technically, it's classified as "in" and "not-in." May be semantics, but there is a difference. I block traffic using inbound rules (e.g., to block FB, I use: deny ip from 69.171.224.0/19 to any in). If you're interested in isolated traffic, netstat is a better tool to look at. To my knowledge, Apple doesn't a) spy on their users, and b) they don't own the entire 17.0.0.0-17.255.255.255 block. – user10355 Dec 18 '11 at 21:19
  • 1
    I might be wrong cksum, but I am pretty sure they DO actually own the entire 17 class A ip address range. – ConstantineK Dec 18 '11 at 21:52
  • 1
    Apple does indeed own 17.everything, so you could use a rule like deny ip from any to 17.0.0.0/8 to block all traffic to that. However, that's not the only address range that Apple uses. You might think about blocking apple.com at the DNS level instead/also. – Gordon Davisson Dec 18 '11 at 22:52
2

I highly recommend Little Snitch. Although it doesn't do anything you couldn't do with free tools, it makes monitoring, configuring, and blocking your system's outgoing traffic on a per-application basis ridiculously easy.

I'm a programmer, and one of those guys who always has a Terminal window open, and yet I still prefer using Little Snitch for this task.

It's not free, but it is cheap. And the free trial is fully functional - the only caveat is you have to manually restart it every 3 hours.

That would probably be all you need to open all your Apple-branded apps and verify whether or not they're phoning the mothership.

And if they are phoning any address outside the 17.x.x.x range, you'd learn that really quick.

  • I would worry that a closed source tool like Little Snitch already ignores traffic it's authors deemed unimportant. I've used Little Snitch's free version for evaluating non-Apple software before though. – Jeff Burdges Dec 19 '11 at 1:51
  • 1
    +1 anyways, always good when people mention user friendly tools that help expose apps phoning home. – Jeff Burdges Dec 19 '11 at 1:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .