OSX.1.5 constantly tries to open internet-connection

B

Bratwurst

Registered
Hi everyone.
Earlier that day I noticed that my Laptop constantly tries to open my DSL-Line (I have to use PPPoE), even though I didn't trigger it.
I guess this has been happening for a few days now, but I didn't recognise it as unwanted behaviour for I'm almost constantly online.

Well, today I completely disconnected my Laptop from my DSL modem, removed everything that was in "Start Objects" and made a full restart, but with no result. No programms were running (at least at finder level), but imediately after log in, the every minute or so a requester came popping up, saying that opening my Internet-connection failed (of course).

I can't remember installing anything lately except of Age of Empires II and a Carbon-patch for The Sims: Living Large. And everything, that came with the Software Update facility, of course.

I would really appreciate any help, epecially how to find out which process tries to connect.

Thanks
b
 
Go to the Network System Prefs pane, click the PPPoE tab, and click the Options button. Uncheck "Connect automatically if needed" and you should be set.

Let me know if that still doesn't help.
 
Hi,
thanks for you answer.

I already did that, and it helped.

But that is not what I'm concerned about. Because even when I check this "Connect automatically if needed", AFAIK the PPPoE-Connection will only be triggered when a process opens a socket or tries to write something to it.

So, if the PPPoE-Connection is being triggered constantly (and repeatedly, even after I manually disconnected), this must mean that some process tries to constantly and repeatedly send something to the Internet behind my back.

Well, in short, I don't know if this is normal behaviour of OSX.1.5 (it didn't happen before I updated from OSX.1.4 [but I also can't remember, if I had the "Connect automatically if needed"-Checkbox checked under OSX.1.4]), of if I got some virus or trojan or a backdoor of some sort on my computer.

Is there a way to find out, which process tries to open the socket ?
"tcpdump -i ppp0 " didn't help me there.

thanks
b
 
ppp0 is your modem. if your DSL connection is over ethernet, then use en0 instead (PPPoE stands for point to point protocol over ethernet)
 
Try disabling Appletalk, and the Network Time Server.

I notice that upon startup, initializing Appletalk will cause a modem to dial.
 
Also, be sure Software Update's automatic checking is off.

And make sure QuickTime Player's prefs are set to not automatically show the hot picks.
 
Ok, thaks for your advice so far. I un-checked "Use Time Server" in the Prefs/Time/Network-Time Panel. I also set Software Update's checking to "manual". Appletalk doesn't work anyway when you use PPPoE (at last so says the Prefs Panel)
I also unchecked "Send PPP-Echo Packets" in the PPPoE-Options.
But this led to no success.

Eventually, I figured out what caused the Problem: Airport !
I found out (with tcpdump), that a UDP-Packet being sent every 5 seconds to 10.0.1.1:192 was likely to cause the connection.
After some googling after Port 192, I stumbled across this Document :

http://sourceforge.net/docman/display_doc.php?docid=12&group_id=7489

There, I found the information that discovery of an Airport Base Station by the configuration programm is done via UDP-Broadcast-Packets on Port 192 (Bingo :) ). I'm still a bit confused for I thought Broadcast-Adresses would always be x.x.x.255, but anyway, switching off Airport in the "Active Network Interfaces"- Panel of Prefs did the trick.

@lethe: you're shure ppp0 is my modem ? My 'Books Modem is not connected to any telephone line. But when I start "tcpdump -i ppp0" and "tcpdump -i en0" simultaniously in two ttys, I see exactly the same Packets on both devices, in and outbound ones, except of that the packets on en0 are encapsulated in PPPoE-Packets while those on ppp0 are not.
I always thought this means that en0 shows the raw data that is being sent to and recieved from the DSL-Line while ppp0 shows the data before (or after respectively) it is being encapsulated to PPPoE packets ?

Well, thanks for your help. At least, now I know It's (hopefully) no malign program causing this effect.

@chemistry_geek: Nice to meet a fellow chemist, dude ... :D

cu
b
 
Originally posted by Bratwurst

@lethe: you're shure ppp0 is my modem ? My 'Books Modem is not connected to any telephone line. But when I start "tcpdump -i ppp0" and "tcpdump -i en0" simultaniously in two ttys, I see exactly the same Packets on both devices, in and outbound ones, except of that the packets on en0 are encapsulated in PPPoE-Packets while those on ppp0 are not.
I always thought this means that en0 shows the raw data that is being sent to and recieved from the DSL-Line while ppp0 shows the data before (or after respectively) it is being encapsulated to PPPoE packets ?
Click to expand...


i thought i was sure, but perhaps i was wrong. your suggestion definitely seems feasible. especially when backed up by experimental evidence.
 
maybe ppp0 is simply the ppp-de/encoding-device, used for any ppp-encoded connection?
Like, if you use the modem, the output of this device is directed to the modem, and if you use PPPoE, the output is directed to the ethernet-device (i.e. usually en0 )?

I can't check that though, 'cause I only got ISDN and DSL and would have to buy an addidtional A/D-converter to get a POTS Line. So this has to remain just a theory at the moment.

any other ideas on that subject ?

bye
b
 
You must log in or register to reply here.
Back
Top