Hello,
I have Mac OS X Leopard 10.5.6 up to date and since few days, the DNS resolution is very slow, about 5 seconds to resolve names.
For example :
# ping test.com
(wait 5 seconds)
PING test.com (205.178.152.103): 56 data bytes
Of course it also happen in firefox and in all other internet applications. Each time I'm loading a web page, I have to wait 5 seconds...
If I try a few seconds later, it answer immediately, but a few minutes later, it take again 5 seconds to resolve the name.
I'm not sure, and maybe it's just a coincidence, but it came just after the installation of Adobe Photoshop 4.
I think about a virus or some mysterious mac os parameters ...
I try dscacheutil -flushcache with no effect.
My /etc/hosts is :
nameserver 212.27.40.240
I only have 1 dns server, and when I try :
nslookup test.com 212.27.40.240
It answer immediately :
Server: 212.27.40.240
Address: 212.27.40.240#53
Non-authoritative answer:
Name: test.com
Address: 205.178.152.103
I tried with many others DNS and also with a local DNS server (bind) with the same result.
The output of :
# dscacheutil -statistics
Overall Statistics:
Average Call Time - 1.298089
Cache Hits - 1813
Cache Misses - 1888
Total External Calls - 2662
Statistics by procedure:
Procedure Cache Hits Cache Misses External Calls
------------------ ---------- ------------ --------------
getpwnam 151 15 166
getpwuid 842 34 876
getpwent 0 0 2
getgrnam 38 18 56
getgrgid 15 16 31
getgrent 0 0 2
getservbyname 7 5 7
getservent 0 0 6
getprotobyname 0 2 2
getfsent 0 0 14
getaddrinfo 0 0 1117
getnameinfo 53 189 242
gethostbyname 537 591 42
gethostbyaddr 16 71 87
gethostbymac 5 4 9
_flushcache 0 0 3
As you can see, "Average Call Time" is very high, it should be 0.0xxxxx
ifconfig output :
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:1b:63:96:ab:e1
media: autoselect status: inactive
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control> none
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 00:1c:b3:ff:fe:86:88:46
media: autoselect <full-duplex> status: inactive
supported media: autoselect <full-duplex>
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet 192.168.0.10 netmask 0xffffff00 broadcast 192.168.0.255
ether 00:1b:63:ca:a9:93
media: autoselect status: active
supported media: autoselect
dtruss output :
# dtruss ping itt.com
SYSCALL(args) = return
ioctl(0x3, 0x80086804, 0xBFFFE488) = 0 0
close(0x3) = 0 0
__sysctl(0xBFFFE35C, 0x2, 0xBFFFE364) = 0 0
bsdthread_register(0x91CD1F30, 0x91D0A2A4, 0x1000) = 0 0
open_nocancel("/dev/urandom\0", 0x0, 0x0) = 3 0
read_nocancel(0x3, "\377~\360U\360\211\303\231l\2725\002\265\327\247\371N`#_\314.\323@\022u\323\346'\224\314\271\0", 0x20) = 32 0
close_nocancel(0x3) = 0 0
mmap(0x0, 0x3000, 0x3, 0x1002, 0x1000000, 0x100000000) = 0x1E000 0
mmap(0x0, 0x200000, 0x3, 0x1002, 0x7000000, 0x100000000) = 0x21000 0
munmap(0x21000, 0xDF000) = 0 0
munmap(0x200000, 0x21000) = 0 0
mmap(0x0, 0x3000, 0x3, 0x1002, 0x1000000, 0x100000000) = 0x21000 0
getpid(0x0, 0x3000, 0x3) = 1436 0
socket(0x2, 0x3, 0x1) = 3 0
getuid(0x2, 0x3, 0x1) = 0 0
setuid(0x0, 0x3, 0x1) = 0 0
getuid(0x0, 0x3, 0x1) = 0 0
getpid(0x0, 0x0, 0x0) = 1436 0
__sysctl(0xBFFFE678, 0x3, 0xBFFFFA98) = 0 0
issetugid(0xBFFFE678, 0x3, 0xBFFFFA98) = 0 0
__sysctl(0xBFFFE534, 0x2, 0xBFFFE4FC) = 0 0
__sysctl(0xBFFFE4FC, 0x2, 0xBFFFE57C) = 0 0
shared_region_check_np(0xBFFFFA78, 0x2, 0xBFFFE57C) = 0 0
stat("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0xBFFFD6E8, 0xBFFFE57C) = 0 0
open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0) = 3 0
pread(0x3, "\312\376\272\276\0", 0x1000, 0x0) = 4096 0
pread(0x3, "\316\372\355\376\a\0", 0x1000, 0x9000) = 4096 0
mmap(0x19000, 0x1000, 0x5, 0x12, 0x3, 0x100000000) = 0x19000 0
mmap(0x1A000, 0x1000, 0x3, 0x12, 0x3, 0x100000000) = 0x1A000 0
mmap(0x1B000, 0x1000, 0x7, 0x12, 0x3, 0x100000000) = 0x1B000 0
mmap(0x1C000, 0x1900, 0x1, 0x12, 0x3, 0x100000000) = 0x1C000 0
fcntl(0x3, 0x2C, 0xFFFFFFFFBFFFBD54) = 0 0
close(0x3) = 0 0
stat("/usr/lib/libgcc_s.1.dylib\0", 0xBFFFD4E8, 0xFFFFFFFFBFFFBD54) = 0 0
stat("/usr/lib/libSystem.B.dylib\0", 0xBFFFD4E8, 0xFFFFFFFFBFFFBD54) = 0 0
stat("/usr/lib/system/libmathCommon.A.dylib\0", 0xBFFFD328, 0xFFFFFFFFBFFFBD54) = 0 0
open("/dev/dtracehelper\0", 0x2, 0xBFFFE504) = 3 0
PING itt.com (199.253.127.99): 56 data bytes
sigaction(0x2, 0xBFFEF6E0, 0x0) = 0 0
sigaction(0x1D, 0xBFFEF6E0, 0x0) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 1 0
recvmsg(0x3, 0xBFFFFAC4, 0x0) = 153 0
setsockopt(0x3, 0xFFFF, 0x400) = 0 0
setsockopt(0x3, 0xFFFF, 0x1002) = 0 0
setsockopt(0x3, 0xFFFF, 0x1001) = 0 0
fstat64(0x1, 0xBFFEEE64, 0x1001) = 0 0
ioctl(0x1, 0x4004667A, 0xBFFEEECC) = 0 0
mmap(0x0, 0x1000000, 0x3, 0x1002, 0x2000000, 0x0) = 0x200000 0
munmap(0x200000, 0x600000) = 0 0
munmap(0x1000000, 0x200000) = 0 0
write_nocancel(0x1, "PING itt.com (199.253.127.99): 56 data bytes\n\0", 0x2D) = 45 0
select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
©select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
^C
tcpdump output (with # ping ita.fr) :
# tcpdump -i en1
00:26:06.469246 IP 192.168.0.10.49985 > 192.168.2.1.domain: 64308+ A? ita.fr. (24)
00:26:06.486473 IP 43.242.3.202.dial.dyn.mana.pf.22369 > 192.168.0.10.42567: UDP, length 85
00:26:06.487552 IP 192.168.0.10.42567 > 43.242.3.202.dial.dyn.mana.pf.22369: UDP, length 35
00:26:07.277453 IP 192.168.0.10.49938 > 192.168.2.1.domain: 44176+ PTR? 43.242.3.202.in-addr.arpa. (43)
00:26:09.346380 IP 192.168.0.10.ntp > time4.euro.apple.com.ntp: NTPv4, Client, length 48
00:26:09.541593 IP time4.euro.apple.com.ntp > 192.168.0.10.ntp: NTPv4, Server, length 48
00:26:11.467716 IP 192.168.0.10.61034 > dns1.proxad.net.domain: 64308+ A? ita.fr. (24)
00:26:11.469940 arp who-has 192.168.0.10 tell 192.168.0.254
00:26:11.469996 arp reply 192.168.0.10 is-at 00:1b:63:ca:a9:93 (oui Unknown)
^C
ps aux output :
# ps aux
$USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
root 15 4.2 0.0 599620 284 ?? Ss 10:27AM 0:23.20 /usr/sbin/update
fanzila 330 3.1 0.8 302188 16000 ?? R 12:06PM 0:41.58 /Applications/Utilities/Terminal.app/Contents/MacOS/Terminal -psn_0_413797
fanzila 994 2.6 8.2 486288 172048 ?? S 11:33PM 5:53.31 /Applications/Firefox.app/Contents/MacOS/firefox-bin -psn_0_1122578
_windowserver 54 2.5 4.6 405476 97200 ?? Ss 10:27AM 6:30.50 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/CoreGraphics.framework/Resources/W
fanzila 1092 1.2 3.2 473732 66856 ?? S 11:52PM 0:34.00 /Applications/Adobe Photoshop CS4/Adobe Photoshop CS4.app/Contents/MacOS/Adobe Photoshop CS4 -psn_0_12
root 33 1.1 0.2 78660 3796 ?? Ss 10:27AM 0:16.79 /usr/sbin/DirectoryService
fanzila 23 0.5 0.4 298916 8368 ?? Ss 10:27AM 0:14.18 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console
fanzila 130 0.5 0.6 305176 13164 ?? S 10:38AM 0:17.71 /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer -psn_0_53261
fanzila 1332 0.0 0.1 2926604 2376 ?? S 12:20AM 0:00.10 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/../bin/wineloader C:\windows\system32
fanzila 1328 0.0 0.1 79096 2432 ?? Ss 12:20AM 0:01.88 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/../bin/wineserver
fanzila 1322 0.0 0.2 2928312 5072 ?? S 12:20AM 0:00.33 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader winewrapper.exe --workdir
fanzila 1321 0.0 0.1 217684 2364 ?? S 12:20AM 0:00.05 /Users/fanzila/Library/Caches/Cleanup At Startup/CrossOver CD Helper.app/Contents/MacOS/CrossOver CD H
fanzila 1317 0.0 0.2 78124 4940 ?? Ss 12:20AM 0:00.11 /usr/bin/perl -w /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/cxmenu --bottle winx
fanzila 1316 0.0 0.2 2928312 5072 ?? Ss 12:20AM 0:00.37 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader winewrapper.exe --run -- /
fanzila 1313 0.0 0.1 227052 2960 ?? Ss 12:20AM 0:00.10 /usr/bin/quartz-wm
fanzila 1305 0.0 1.2 327344 25868 ?? S 12:20AM 0:01.48 /Applications/CrossOver.app/Contents/MacOS/CrossOver -psn_0_1335622
fanzila 1304 0.0 0.1 225336 3004 ?? S 12:20AM 0:00.13 /Users/fanzila/Applications/CrossOver/DHO.app/Contents/MacOS/CrossOver Helper with Feedback -psn_0_133
fanzila 1097 0.0 0.2 91876 4644 ?? S 11:52PM 0:00.28 /System/Library/Services/AppleSpell.service/Contents/MacOS/AppleSpell -psn_0_1212712
fanzila 1094 0.0 0.7 327036 15668 ?? S 11:52PM 0:14.38 /Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_1208615
fanzila 1093 0.0 0.1 76432 1540 ?? Ss 11:52PM 0:00.07 /Applications/Adobe Photoshop CS4/Adobe Photoshop CS4.app/Contents/Frameworks/AdobeCrashReporter.frame
fanzila 993 0.0 2.9 430152 60324 ?? U 11:33PM 0:20.24 /Applications/Path Finder.app/Contents/MacOS/Path Finder -psn_0_1118481
fanzila 983 0.0 1.9 399876 39104 ?? S 11:32PM 0:19.28 /Applications/Skype.app/Contents/MacOS/Skype -psn_0_1114384
fanzila 982 0.0 1.1 339696 22972 ?? U 11:32PM 0:09.25 /Applications/Adium.app/Contents/MacOS/Adium -psn_0_1110287
fanzila 967 0.0 2.6 355348 53504 ?? S 11:32PM 0:08.98 /Applications/Mail.app/Contents/MacOS/Mail -psn_0_1106190
fanzila 921 0.0 0.0 600252 944 s001 S+ 7:07PM 0:00.06 /bin/bash
fanzila 912 0.0 0.0 600252 756 s001 S 7:07PM 0:00.01 -bash
root 911 0.0 0.1 76592 1104 s001 Ss 7:07PM 0:00.03 login -pf fanzila
_mdnsresponder 646 0.0 0.1 77304 1164 ?? Ss 4:03PM 0:00.10 /usr/sbin/mDNSResponder -launchd
fanzila 635 0.0 0.0 601896 804 ?? S 4:02PM 0:01.19 /usr/local/bin/gpg-agent --launchd --use-standard-socket --write-env-file
root 596 0.0 0.0 600252 952 s000 S 3:55PM 0:00.43 /bin/bash
fanzila 341 0.0 0.0 600252 944 s000 S 12:06PM 0:00.07 /bin/bash
fanzila 332 0.0 0.0 600252 756 s000 S 12:06PM 0:00.02 -bash
root 331 0.0 0.1 76592 1104 s000 Ss 12:06PM 0:00.03 login -pf fanzila
fanzila 298 0.0 0.6 268748 12604 ?? U 11:54AM 0:00.91 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 297 0.0 0.4 264760 8108 ?? S 11:54AM 0:00.51 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 296 0.0 0.8 272252 16328 ?? S 11:54AM 0:01.51 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 295 0.0 0.6 270808 12488 ?? S 11:54AM 0:01.51 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 294 0.0 0.9 299344 17828 ?? S 11:54AM 0:03.26 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
nobody 156 0.0 0.0 76776 632 ?? Ss 10:38AM 0:00.01 /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd -launchd
fanzila 151 0.0 0.1 223464 2408 ?? S 10:38AM 0:00.12 /Applications/iTunes.app/Contents/Resources/iTunesHelper.app/Contents/MacOS/iTunesHelper -psn_0_118813
fanzila 144 0.0 0.3 314696 7184 ?? S 10:38AM 0:03.93 /Library/PreferencePanes/Witch.prefPane/Contents/Resources/witchdaemon.app/Contents/MacOS/witchdaemon
fanzila 137 0.0 0.1 214952 2960 ?? S 10:38AM 0:00.22 /Library/Printers/hp/hpio/HPEventHandler.app/Contents/MacOS/HPEventHandler -psn_0_69649
fanzila 129 0.0 0.6 279688 12996 ?? S 10:38AM 0:15.74 /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock -psn_0_49164
fanzila 128 0.0 0.3 136856 6420 ?? S 10:38AM 0:08.23 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS.framework/Support/ATSServer
fanzila 127 0.0 0.0 76504 536 ?? S 10:38AM 0:00.01 /usr/sbin/pboard
fanzila 126 0.0 0.1 220304 2248 ?? S 10:38AM 0:00.28 /usr/sbin/UserEventAgent -l Aqua
fanzila 125 0.0 0.2 225908 3964 ?? S 10:38AM 0:00.26 /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
fanzila 120 0.0 0.2 257568 3348 ?? S 10:38AM 0:00.17 /System/Library/CoreServices/AirPort Base Station Agent.app/Contents/MacOS/AirPort Base Station Agent
fanzila 114 0.0 0.0 600820 560 ?? Ss 10:38AM 0:00.51 /sbin/launchd
root 108 0.0 0.2 79644 3304 ?? Ss 10:29AM 0:01.10 /usr/sbin/coreaudiod
root 95 0.0 0.1 77928 1388 ?? S 10:27AM 0:00.13 /Library/Printers/hp/hpio/HPIO Trap Monitor.app/Contents/MacOS/HPIO Trap Monitor
root 87 0.0 0.0 76572 732 ?? Ss 10:27AM 0:00.12 /Library/Frameworks/HPServicesInterface.framework/Runtime/hpusbmond
root 47 0.0 0.1 86716 1836 ?? Ss 10:27AM 0:00.16 /usr/sbin/blued
root 45 0.0 1.3 116160 27116 ?? Ss 10:27AM 0:05.43 /System/Library/CoreServices/coreservicesd
daemon 43 0.0 0.0 75356 808 ?? Ss 10:27AM 0:01.88 /usr/sbin/distnoted
root 40 0.0 0.1 75704 1500 ?? Ss 10:27AM 0:00.61 /usr/libexec/ApplicationFirewall/socketfilterfw
root 38 0.0 0.0 75388 672 ?? Ss 10:27AM 0:00.03 autofsd
root 35 0.0 0.1 77000 2080 ?? Ss 10:27AM 0:13.02 /usr/sbin/configd
root 32 0.0 0.1 75460 1104 ?? Ss 10:27AM 0:01.04 /usr/sbin/diskarbitrationd
root 29 0.0 0.0 75376 700 ?? Ss 10:27AM 0:00.01 /sbin/dynamic_pager -F /private/var/vm/swapfile
root 27 0.0 0.1 85768 1476 ?? Ss 10:27AM 0:01.70 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/
root 26 0.0 0.0 75896 600 ?? Ss 10:27AM 0:00.01 /usr/libexec/hidd
root 24 0.0 0.0 75448 644 ?? Ss 10:27AM 0:00.01 /usr/sbin/KernelEventAgent
root 21 0.0 2.9 259112 61136 ?? Ss 10:27AM 2:08.30 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds
root 19 0.0 0.1 77316 2248 ?? Ss 10:27AM 0:00.64 /usr/sbin/securityd -i
root 16 0.0 0.0 75372 640 ?? Ss 10:27AM 0:00.01 /sbin/SystemStarter
root 14 0.0 0.0 75900 824 ?? Ss 10:27AM 0:02.07 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift
root 12 0.0 0.0 601332 464 ?? Ss 10:27AM 0:00.57 /usr/sbin/syslogd
root 11 0.0 0.0 600236 484 ?? Ss 10:27AM 0:00.69 /usr/sbin/notifyd
root 10 0.0 0.1 75968 1228 ?? Ss 10:27AM 0:00.86 /usr/libexec/kextd
root 1460 0.0 0.0 599788 452 s000 R+ 12:27AM 0:00.01 ps aux
root 1 0.0 0.0 600820 564 ?? Ss 10:27AM 0:00.50 /sbin/launchd
_spotlight 1453 0.0 0.1 89116 2000 ?? SNs 12:26AM 0:00.13 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdw
fanzila 1425 0.0 0.2 122524 3432 ?? SNs 12:21AM 0:00.24 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdw
fanzila 1365 0.0 0.3 2931372 6596 ?? Ss 12:21AM 0:00.36 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/../bin/wineloader C:\windows\system32
fanzila 1362 0.0 0.1 78948 1364 ?? S 12:21AM 0:00.11 /System/Library/Frameworks/CoreMIDIServer.framework/MIDIServer
Many thanks for your help.
I have Mac OS X Leopard 10.5.6 up to date and since few days, the DNS resolution is very slow, about 5 seconds to resolve names.
For example :
# ping test.com
(wait 5 seconds)
PING test.com (205.178.152.103): 56 data bytes
Of course it also happen in firefox and in all other internet applications. Each time I'm loading a web page, I have to wait 5 seconds...
If I try a few seconds later, it answer immediately, but a few minutes later, it take again 5 seconds to resolve the name.
I'm not sure, and maybe it's just a coincidence, but it came just after the installation of Adobe Photoshop 4.
I think about a virus or some mysterious mac os parameters ...
I try dscacheutil -flushcache with no effect.
My /etc/hosts is :
nameserver 212.27.40.240
I only have 1 dns server, and when I try :
nslookup test.com 212.27.40.240
It answer immediately :
Server: 212.27.40.240
Address: 212.27.40.240#53
Non-authoritative answer:
Name: test.com
Address: 205.178.152.103
I tried with many others DNS and also with a local DNS server (bind) with the same result.
The output of :
# dscacheutil -statistics
Overall Statistics:
Average Call Time - 1.298089
Cache Hits - 1813
Cache Misses - 1888
Total External Calls - 2662
Statistics by procedure:
Procedure Cache Hits Cache Misses External Calls
------------------ ---------- ------------ --------------
getpwnam 151 15 166
getpwuid 842 34 876
getpwent 0 0 2
getgrnam 38 18 56
getgrgid 15 16 31
getgrent 0 0 2
getservbyname 7 5 7
getservent 0 0 6
getprotobyname 0 2 2
getfsent 0 0 14
getaddrinfo 0 0 1117
getnameinfo 53 189 242
gethostbyname 537 591 42
gethostbyaddr 16 71 87
gethostbymac 5 4 9
_flushcache 0 0 3
As you can see, "Average Call Time" is very high, it should be 0.0xxxxx
ifconfig output :
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether 00:1b:63:96:ab:e1
media: autoselect status: inactive
supported media: autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,hw-loopback> 10baseT/UTP <full-duplex,flow-control> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,hw-loopback> 100baseTX <full-duplex,flow-control> 1000baseT <full-duplex> 1000baseT <full-duplex,hw-loopback> 1000baseT <full-duplex,flow-control> none
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr 00:1c:b3:ff:fe:86:88:46
media: autoselect <full-duplex> status: inactive
supported media: autoselect <full-duplex>
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet 192.168.0.10 netmask 0xffffff00 broadcast 192.168.0.255
ether 00:1b:63:ca:a9:93
media: autoselect status: active
supported media: autoselect
dtruss output :
# dtruss ping itt.com
SYSCALL(args) = return
ioctl(0x3, 0x80086804, 0xBFFFE488) = 0 0
close(0x3) = 0 0
__sysctl(0xBFFFE35C, 0x2, 0xBFFFE364) = 0 0
bsdthread_register(0x91CD1F30, 0x91D0A2A4, 0x1000) = 0 0
open_nocancel("/dev/urandom\0", 0x0, 0x0) = 3 0
read_nocancel(0x3, "\377~\360U\360\211\303\231l\2725\002\265\327\247\371N`#_\314.\323@\022u\323\346'\224\314\271\0", 0x20) = 32 0
close_nocancel(0x3) = 0 0
mmap(0x0, 0x3000, 0x3, 0x1002, 0x1000000, 0x100000000) = 0x1E000 0
mmap(0x0, 0x200000, 0x3, 0x1002, 0x7000000, 0x100000000) = 0x21000 0
munmap(0x21000, 0xDF000) = 0 0
munmap(0x200000, 0x21000) = 0 0
mmap(0x0, 0x3000, 0x3, 0x1002, 0x1000000, 0x100000000) = 0x21000 0
getpid(0x0, 0x3000, 0x3) = 1436 0
socket(0x2, 0x3, 0x1) = 3 0
getuid(0x2, 0x3, 0x1) = 0 0
setuid(0x0, 0x3, 0x1) = 0 0
getuid(0x0, 0x3, 0x1) = 0 0
getpid(0x0, 0x0, 0x0) = 1436 0
__sysctl(0xBFFFE678, 0x3, 0xBFFFFA98) = 0 0
issetugid(0xBFFFE678, 0x3, 0xBFFFFA98) = 0 0
__sysctl(0xBFFFE534, 0x2, 0xBFFFE4FC) = 0 0
__sysctl(0xBFFFE4FC, 0x2, 0xBFFFE57C) = 0 0
shared_region_check_np(0xBFFFFA78, 0x2, 0xBFFFE57C) = 0 0
stat("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0xBFFFD6E8, 0xBFFFE57C) = 0 0
open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0) = 3 0
pread(0x3, "\312\376\272\276\0", 0x1000, 0x0) = 4096 0
pread(0x3, "\316\372\355\376\a\0", 0x1000, 0x9000) = 4096 0
mmap(0x19000, 0x1000, 0x5, 0x12, 0x3, 0x100000000) = 0x19000 0
mmap(0x1A000, 0x1000, 0x3, 0x12, 0x3, 0x100000000) = 0x1A000 0
mmap(0x1B000, 0x1000, 0x7, 0x12, 0x3, 0x100000000) = 0x1B000 0
mmap(0x1C000, 0x1900, 0x1, 0x12, 0x3, 0x100000000) = 0x1C000 0
fcntl(0x3, 0x2C, 0xFFFFFFFFBFFFBD54) = 0 0
close(0x3) = 0 0
stat("/usr/lib/libgcc_s.1.dylib\0", 0xBFFFD4E8, 0xFFFFFFFFBFFFBD54) = 0 0
stat("/usr/lib/libSystem.B.dylib\0", 0xBFFFD4E8, 0xFFFFFFFFBFFFBD54) = 0 0
stat("/usr/lib/system/libmathCommon.A.dylib\0", 0xBFFFD328, 0xFFFFFFFFBFFFBD54) = 0 0
open("/dev/dtracehelper\0", 0x2, 0xBFFFE504) = 3 0
PING itt.com (199.253.127.99): 56 data bytes
sigaction(0x2, 0xBFFEF6E0, 0x0) = 0 0
sigaction(0x1D, 0xBFFEF6E0, 0x0) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 1 0
recvmsg(0x3, 0xBFFFFAC4, 0x0) = 153 0
setsockopt(0x3, 0xFFFF, 0x400) = 0 0
setsockopt(0x3, 0xFFFF, 0x1002) = 0 0
setsockopt(0x3, 0xFFFF, 0x1001) = 0 0
fstat64(0x1, 0xBFFEEE64, 0x1001) = 0 0
ioctl(0x1, 0x4004667A, 0xBFFEEECC) = 0 0
mmap(0x0, 0x1000000, 0x3, 0x1002, 0x2000000, 0x0) = 0x200000 0
munmap(0x200000, 0x600000) = 0 0
munmap(0x1000000, 0x200000) = 0 0
write_nocancel(0x1, "PING itt.com (199.253.127.99): 56 data bytes\n\0", 0x2D) = 45 0
select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
©select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
select(0x4, 0xBFFFF9DC, 0x0, 0x0, 0xBFFFFB30) = 0 0
sendto(0x3, 0x5234, 0x40) = 64 0
^C
tcpdump output (with # ping ita.fr) :
# tcpdump -i en1
00:26:06.469246 IP 192.168.0.10.49985 > 192.168.2.1.domain: 64308+ A? ita.fr. (24)
00:26:06.486473 IP 43.242.3.202.dial.dyn.mana.pf.22369 > 192.168.0.10.42567: UDP, length 85
00:26:06.487552 IP 192.168.0.10.42567 > 43.242.3.202.dial.dyn.mana.pf.22369: UDP, length 35
00:26:07.277453 IP 192.168.0.10.49938 > 192.168.2.1.domain: 44176+ PTR? 43.242.3.202.in-addr.arpa. (43)
00:26:09.346380 IP 192.168.0.10.ntp > time4.euro.apple.com.ntp: NTPv4, Client, length 48
00:26:09.541593 IP time4.euro.apple.com.ntp > 192.168.0.10.ntp: NTPv4, Server, length 48
00:26:11.467716 IP 192.168.0.10.61034 > dns1.proxad.net.domain: 64308+ A? ita.fr. (24)
00:26:11.469940 arp who-has 192.168.0.10 tell 192.168.0.254
00:26:11.469996 arp reply 192.168.0.10 is-at 00:1b:63:ca:a9:93 (oui Unknown)
^C
ps aux output :
# ps aux
$USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
root 15 4.2 0.0 599620 284 ?? Ss 10:27AM 0:23.20 /usr/sbin/update
fanzila 330 3.1 0.8 302188 16000 ?? R 12:06PM 0:41.58 /Applications/Utilities/Terminal.app/Contents/MacOS/Terminal -psn_0_413797
fanzila 994 2.6 8.2 486288 172048 ?? S 11:33PM 5:53.31 /Applications/Firefox.app/Contents/MacOS/firefox-bin -psn_0_1122578
_windowserver 54 2.5 4.6 405476 97200 ?? Ss 10:27AM 6:30.50 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/CoreGraphics.framework/Resources/W
fanzila 1092 1.2 3.2 473732 66856 ?? S 11:52PM 0:34.00 /Applications/Adobe Photoshop CS4/Adobe Photoshop CS4.app/Contents/MacOS/Adobe Photoshop CS4 -psn_0_12
root 33 1.1 0.2 78660 3796 ?? Ss 10:27AM 0:16.79 /usr/sbin/DirectoryService
fanzila 23 0.5 0.4 298916 8368 ?? Ss 10:27AM 0:14.18 /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow console
fanzila 130 0.5 0.6 305176 13164 ?? S 10:38AM 0:17.71 /System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer -psn_0_53261
fanzila 1332 0.0 0.1 2926604 2376 ?? S 12:20AM 0:00.10 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/../bin/wineloader C:\windows\system32
fanzila 1328 0.0 0.1 79096 2432 ?? Ss 12:20AM 0:01.88 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/../bin/wineserver
fanzila 1322 0.0 0.2 2928312 5072 ?? S 12:20AM 0:00.33 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader winewrapper.exe --workdir
fanzila 1321 0.0 0.1 217684 2364 ?? S 12:20AM 0:00.05 /Users/fanzila/Library/Caches/Cleanup At Startup/CrossOver CD Helper.app/Contents/MacOS/CrossOver CD H
fanzila 1317 0.0 0.2 78124 4940 ?? Ss 12:20AM 0:00.11 /usr/bin/perl -w /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/cxmenu --bottle winx
fanzila 1316 0.0 0.2 2928312 5072 ?? Ss 12:20AM 0:00.37 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/bin/wineloader winewrapper.exe --run -- /
fanzila 1313 0.0 0.1 227052 2960 ?? Ss 12:20AM 0:00.10 /usr/bin/quartz-wm
fanzila 1305 0.0 1.2 327344 25868 ?? S 12:20AM 0:01.48 /Applications/CrossOver.app/Contents/MacOS/CrossOver -psn_0_1335622
fanzila 1304 0.0 0.1 225336 3004 ?? S 12:20AM 0:00.13 /Users/fanzila/Applications/CrossOver/DHO.app/Contents/MacOS/CrossOver Helper with Feedback -psn_0_133
fanzila 1097 0.0 0.2 91876 4644 ?? S 11:52PM 0:00.28 /System/Library/Services/AppleSpell.service/Contents/MacOS/AppleSpell -psn_0_1212712
fanzila 1094 0.0 0.7 327036 15668 ?? S 11:52PM 0:14.38 /Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_1208615
fanzila 1093 0.0 0.1 76432 1540 ?? Ss 11:52PM 0:00.07 /Applications/Adobe Photoshop CS4/Adobe Photoshop CS4.app/Contents/Frameworks/AdobeCrashReporter.frame
fanzila 993 0.0 2.9 430152 60324 ?? U 11:33PM 0:20.24 /Applications/Path Finder.app/Contents/MacOS/Path Finder -psn_0_1118481
fanzila 983 0.0 1.9 399876 39104 ?? S 11:32PM 0:19.28 /Applications/Skype.app/Contents/MacOS/Skype -psn_0_1114384
fanzila 982 0.0 1.1 339696 22972 ?? U 11:32PM 0:09.25 /Applications/Adium.app/Contents/MacOS/Adium -psn_0_1110287
fanzila 967 0.0 2.6 355348 53504 ?? S 11:32PM 0:08.98 /Applications/Mail.app/Contents/MacOS/Mail -psn_0_1106190
fanzila 921 0.0 0.0 600252 944 s001 S+ 7:07PM 0:00.06 /bin/bash
fanzila 912 0.0 0.0 600252 756 s001 S 7:07PM 0:00.01 -bash
root 911 0.0 0.1 76592 1104 s001 Ss 7:07PM 0:00.03 login -pf fanzila
_mdnsresponder 646 0.0 0.1 77304 1164 ?? Ss 4:03PM 0:00.10 /usr/sbin/mDNSResponder -launchd
fanzila 635 0.0 0.0 601896 804 ?? S 4:02PM 0:01.19 /usr/local/bin/gpg-agent --launchd --use-standard-socket --write-env-file
root 596 0.0 0.0 600252 952 s000 S 3:55PM 0:00.43 /bin/bash
fanzila 341 0.0 0.0 600252 944 s000 S 12:06PM 0:00.07 /bin/bash
fanzila 332 0.0 0.0 600252 756 s000 S 12:06PM 0:00.02 -bash
root 331 0.0 0.1 76592 1104 s000 Ss 12:06PM 0:00.03 login -pf fanzila
fanzila 298 0.0 0.6 268748 12604 ?? U 11:54AM 0:00.91 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 297 0.0 0.4 264760 8108 ?? S 11:54AM 0:00.51 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 296 0.0 0.8 272252 16328 ?? S 11:54AM 0:01.51 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 295 0.0 0.6 270808 12488 ?? S 11:54AM 0:01.51 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
fanzila 294 0.0 0.9 299344 17828 ?? S 11:54AM 0:03.26 /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Contents/MacOS/DashboardC
nobody 156 0.0 0.0 76776 632 ?? Ss 10:38AM 0:00.01 /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/usbmuxd -launchd
fanzila 151 0.0 0.1 223464 2408 ?? S 10:38AM 0:00.12 /Applications/iTunes.app/Contents/Resources/iTunesHelper.app/Contents/MacOS/iTunesHelper -psn_0_118813
fanzila 144 0.0 0.3 314696 7184 ?? S 10:38AM 0:03.93 /Library/PreferencePanes/Witch.prefPane/Contents/Resources/witchdaemon.app/Contents/MacOS/witchdaemon
fanzila 137 0.0 0.1 214952 2960 ?? S 10:38AM 0:00.22 /Library/Printers/hp/hpio/HPEventHandler.app/Contents/MacOS/HPEventHandler -psn_0_69649
fanzila 129 0.0 0.6 279688 12996 ?? S 10:38AM 0:15.74 /System/Library/CoreServices/Dock.app/Contents/MacOS/Dock -psn_0_49164
fanzila 128 0.0 0.3 136856 6420 ?? S 10:38AM 0:08.23 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS.framework/Support/ATSServer
fanzila 127 0.0 0.0 76504 536 ?? S 10:38AM 0:00.01 /usr/sbin/pboard
fanzila 126 0.0 0.1 220304 2248 ?? S 10:38AM 0:00.28 /usr/sbin/UserEventAgent -l Aqua
fanzila 125 0.0 0.2 225908 3964 ?? S 10:38AM 0:00.26 /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
fanzila 120 0.0 0.2 257568 3348 ?? S 10:38AM 0:00.17 /System/Library/CoreServices/AirPort Base Station Agent.app/Contents/MacOS/AirPort Base Station Agent
fanzila 114 0.0 0.0 600820 560 ?? Ss 10:38AM 0:00.51 /sbin/launchd
root 108 0.0 0.2 79644 3304 ?? Ss 10:29AM 0:01.10 /usr/sbin/coreaudiod
root 95 0.0 0.1 77928 1388 ?? S 10:27AM 0:00.13 /Library/Printers/hp/hpio/HPIO Trap Monitor.app/Contents/MacOS/HPIO Trap Monitor
root 87 0.0 0.0 76572 732 ?? Ss 10:27AM 0:00.12 /Library/Frameworks/HPServicesInterface.framework/Runtime/hpusbmond
root 47 0.0 0.1 86716 1836 ?? Ss 10:27AM 0:00.16 /usr/sbin/blued
root 45 0.0 1.3 116160 27116 ?? Ss 10:27AM 0:05.43 /System/Library/CoreServices/coreservicesd
daemon 43 0.0 0.0 75356 808 ?? Ss 10:27AM 0:01.88 /usr/sbin/distnoted
root 40 0.0 0.1 75704 1500 ?? Ss 10:27AM 0:00.61 /usr/libexec/ApplicationFirewall/socketfilterfw
root 38 0.0 0.0 75388 672 ?? Ss 10:27AM 0:00.03 autofsd
root 35 0.0 0.1 77000 2080 ?? Ss 10:27AM 0:13.02 /usr/sbin/configd
root 32 0.0 0.1 75460 1104 ?? Ss 10:27AM 0:01.04 /usr/sbin/diskarbitrationd
root 29 0.0 0.0 75376 700 ?? Ss 10:27AM 0:00.01 /sbin/dynamic_pager -F /private/var/vm/swapfile
root 27 0.0 0.1 85768 1476 ?? Ss 10:27AM 0:01.70 /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/
root 26 0.0 0.0 75896 600 ?? Ss 10:27AM 0:00.01 /usr/libexec/hidd
root 24 0.0 0.0 75448 644 ?? Ss 10:27AM 0:00.01 /usr/sbin/KernelEventAgent
root 21 0.0 2.9 259112 61136 ?? Ss 10:27AM 2:08.30 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds
root 19 0.0 0.1 77316 2248 ?? Ss 10:27AM 0:00.64 /usr/sbin/securityd -i
root 16 0.0 0.0 75372 640 ?? Ss 10:27AM 0:00.01 /sbin/SystemStarter
root 14 0.0 0.0 75900 824 ?? Ss 10:27AM 0:02.07 /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift
root 12 0.0 0.0 601332 464 ?? Ss 10:27AM 0:00.57 /usr/sbin/syslogd
root 11 0.0 0.0 600236 484 ?? Ss 10:27AM 0:00.69 /usr/sbin/notifyd
root 10 0.0 0.1 75968 1228 ?? Ss 10:27AM 0:00.86 /usr/libexec/kextd
root 1460 0.0 0.0 599788 452 s000 R+ 12:27AM 0:00.01 ps aux
root 1 0.0 0.0 600820 564 ?? Ss 10:27AM 0:00.50 /sbin/launchd
_spotlight 1453 0.0 0.1 89116 2000 ?? SNs 12:26AM 0:00.13 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdw
fanzila 1425 0.0 0.2 122524 3432 ?? SNs 12:21AM 0:00.24 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mdw
fanzila 1365 0.0 0.3 2931372 6596 ?? Ss 12:21AM 0:00.36 /Applications/CrossOver.app/Contents/SharedSupport/CrossOver/lib/../bin/wineloader C:\windows\system32
fanzila 1362 0.0 0.1 78948 1364 ?? S 12:21AM 0:00.11 /System/Library/Frameworks/CoreMIDIServer.framework/MIDIServer
Many thanks for your help.
