redvineyard Posted June 5, 2008 Share Posted June 5, 2008 Installed Kallaway on Dell XPS 610. Thanks to reading a lot of post in the forums. Everything works great. Except Little Snitch reports network activity to various ip's during torrent use in Transmisison. This concerns me in that I am concerned it is below the control of Peer Gaurdian and Little snitch. Should the kernell talk on the network at all? At that level? It only is active in Transmission and not Azureus, or any other time. I have done many searches on the net and am learning a whole lot about Mach architecture but not anything that I've found that directly addresses this. I thought applications accessed the net. I wasnt aware that the kernel itself might - except on boot. Thx in advance. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/ Share on other sites More sharing options...
turandota Posted June 5, 2008 Share Posted June 5, 2008 Hi. You need to check and configure Little Snitch's preferences through an admin account. Also, you didn't state if it is LS 1 or 2. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-772735 Share on other sites More sharing options...
redvineyard Posted June 6, 2008 Author Share Posted June 6, 2008 Thank you. Its 2. And I'm using an Admin account and have even gone so far in the Rules as to set All Applications to Deny Access and then only allowed Transmission and Firefox. And I still get a leek from the Mac OS X Kernal /mach_kernel. The Ips look like P2P IP's. This only happens when using Transmission and not Azureus, or at any other time. Its just an ocassional stream of IP's from the mach_kernel. And it doesnt appear to be a rule to set to control the kernel. I've seen after posting this question, one or two other remarks concerning little snitch showing kernel activity while using P2P. But I've noticed recently that my vmnet-natd (vmware) is active while using Azureaus so I'm beginning to wonder if Little Snitch has some kind of bug in it. I'm a little new to Mac with a little Linux knowledge. I'm good with computers though, but I dont know enough about kernels. I assume the kernel should be a very low level interface managing apps or utilities that access the internet. I'm still reading. Thanks for your response. O yeah, you said Prefs instead of Rules in LS. I ddint see anything in Prefs that I knew would solve this. And about the Vmware I was using Fusion to emulate Vista at first but I found it easier to Dual Boot by selecting the hard drive using Dells system Boot menu. I was able to block vmnet-natd, if I remember right, but I dont care much for Azureus. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-772899 Share on other sites More sharing options...
redvineyard Posted June 6, 2008 Author Share Posted June 6, 2008 Recently while pocking around in Rules for LS I realized I had been searching for the kernel as App rather than a service. I set the rule to Deny Access to the kernel with no change. It still reports it in LS as connecting to various IP's. I've removed almost all services and App access rules in LS including the recommended services such as mnblookup, mDNSResponder, ntpd, multicast, ect. And I can still see it in LS. However I do not see the kernel as a source in PeerGaurdian only in LS. I may be overly concerned but I've never liked ET poking around in my computer. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-772949 Share on other sites More sharing options...
redvineyard Posted June 6, 2008 Author Share Posted June 6, 2008 Last Post, in case anybody finds this useful. The Whois of the logs from LS point mostly to an Asian Registry. Consists of 0 bytes sent and 64 bytes received. It does show by doing an netstat -n that I have an established connection with the address listed in LS for the kernel using the port used for Transmission. I'm assuming without knowingly exactly what I'm saying that these are some kind of pings. Just thought it was interesting. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-772965 Share on other sites More sharing options...
redvineyard Posted June 6, 2008 Author Share Posted June 6, 2008 Footnote: After reading a little more in devoloper pages I see that the "kernel" is a catch all in Mac OS X wich includes the microkernel, the BSD, including the I/O and Networking. So I assume it is perfectly reasonable that the "kernel" is doing network management. I'm learning. However PeerGaurdian doesnt appear to work at that level to block addresses. I hope this was useful for someone else. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-773006 Share on other sites More sharing options...
BigPimpin Posted June 6, 2008 Share Posted June 6, 2008 No, that would not be reasonable. The kernel shouldn't be generating any network activity on its own. What you're seeing suggests that your installation (Kalyway?) has spyware built into it. That would make me worry. A lot. Kudos to you for noticing it. It might not even be Kalyway's problem. With all the hacked up drivers and kexts floating around out there any one of them could be the culprit. It wouldn't surprise me if some people download the real deal, modify it to add spyware, and then re-seed new torrents with the infected version. More people would get interested in this topic if it was called, "Is Kalyway Spyware?". Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-774042 Share on other sites More sharing options...
redvineyard Posted June 7, 2008 Author Share Posted June 7, 2008 Yes it concerned me enough that I removed Kalyway.There were other things that had me concerned. From the beginning I had problems communicating with ISP services as if I was going through a Proxy and trying to dl Mcafee or Norton was blocked in VMWare Fusion on the Vista emulation. Lastly and very recently I lost a large storage folder on a shared drive on one of my other computers linked to the Mac. I dont think its anything in Kalyway. Like you said. I installed the sound patch, the efi patch to boot correctly, and many other applications. Last night and this morning after installing a new game on the Vista side from Dual Boot. My Com surraget dllhost.dll went bonkers replicating itself in memory. It took up 2 gigs before I shut done and reinstalled. I now have a clean computer. I had to put the Mac drive in a raid before I could wipe out the Mac boot partition for Vista install. But everything seems alright. Mac is cool and only as secure as the person using it. I wonder what ever happened to honor among ... Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-774286 Share on other sites More sharing options...
BigPimpin Posted June 7, 2008 Share Posted June 7, 2008 Glad you got it cleaned up. I use my computer enough to know when it's not "acting right". Whenever it does that one of the first things I do is fire up a packet sniffer to see if there's any underground network activity. Especially after I install new software. The worst software, though, is the sneaky one that you don't realize you're installing. One other thing that occurred to me: A covert connection in the kernel probably wouldn't be visible with 'netstat'. Why go through all the trouble of setting up a normal network socket when there are easier ways to do it? Anything's possible if code is running in the kernel, however, so never say never. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-774369 Share on other sites More sharing options...
turandota Posted June 9, 2008 Share Posted June 9, 2008 Sounds interesting. BigPimpin is right. The kernel should not be generating any network activity on its own. Perhaps its time to go to a certain bay and redownload the os again, from a reputable poster. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-776490 Share on other sites More sharing options...
chawknz Posted July 14, 2008 Share Posted July 14, 2008 So I was searching on Google for this issue and happened upon this thread. I felt the need to reply since the misinformation in the last few posts are quite extreme. The kernel messages you all are getting have nothing to do with Kalyway and everything to do with your running torrents. I am using the vanilla kernel that came with the 10.5.4 update , using Kalyway, so there is NO chance that "spyware" is somehow active in my kernel due to the Kalyway install. Complete and total b.s. I know this post is old, but this had to be clarified for those like me who may happen upon it. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-819252 Share on other sites More sharing options...
redvineyard Posted July 18, 2008 Author Share Posted July 18, 2008 Thank you for your input. ummm..... I think thats why I titled it "Little Snitch reports Mach Kernel activity during TRANSMISSION use" Regardless of when it is doing it. It shouldnt be doing it at all. Should it? It was a question. I stated my lack of experience and was hoping for insight. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-823702 Share on other sites More sharing options...
Walgman Posted July 18, 2008 Share Posted July 18, 2008 I am on a Macbook Pro and I am experiencing this kernal activity with transmission use also. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-824047 Share on other sites More sharing options...
SamuV Posted January 28, 2009 Share Posted January 28, 2009 Sorry to resurrect an old thread, but I have a small bit of input. I run OS X Leopard on a G5 Mac, it's a legit copy on an Apple machine. No hacks, no mods. I have LS 2 as well and have noticed Kernel activity that halts as soon as I shut down transmission. I don't think you need to worry about the OS, it's either a bug in LS 2 or Transmission. I'm gonna shoot the guys at Transmission an email and ask what's up, but don't worry about your OS or drivers. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1060390 Share on other sites More sharing options...
redvineyard Posted February 1, 2009 Author Share Posted February 1, 2009 Thanks alot for the current info. Just happened to stop by again....I am currently Beta Testing for Win 7 using MS VM 2007 with XP in it and thought I'd try out Mac again. I was looking through the Forums to see what to use. I think Ill go with Kalway. I always thought it had to do something with Transmision but I had installed a lot of other stuff that might not have been clean. I didnt think it was the OS directly anyway I love Mac but u should check out Win 7 too. Its not solid yet. But there are some nice new features. And thank you again for your response. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1064347 Share on other sites More sharing options...
redvineyard Posted February 11, 2009 Author Share Posted February 11, 2009 Just recently Got iaktos installed....Cleanest quickest install ever.....I just purchased Norton 2009 Security and it works great. I like having control over what calls home....Very happy with Mac at the moment...Not so happy with MS Win 7...Something to do with Teredo crashing all the time....An old thread suggested that the problem was LS2 misreporting what was active....I'm wondering what Norton will show with the iaktos install....Thx again. I never could have gotten Mac installed if it hadnt been for the forums. Now as far as cuspd is concerned....Just kidding. Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1076821 Share on other sites More sharing options...
tinush Posted March 9, 2009 Share Posted March 9, 2009 My Mac os x kernel connects to this ip adres 59.178.60.12 i'm using iatkos v5i and voodoo kernel 9.5 blocked it with LS anyone else EDIT; after some study it must be utorrent and transmissions related Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1102797 Share on other sites More sharing options...
Beerkex'd Posted March 14, 2009 Share Posted March 14, 2009 http://wq.apnic.net/apnic-bin/whois.pl % [whois.apnic.net node-1] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html inetnum: 59.176.0.0 - 59.185.255.255 netname: MTNLISP descr: MTNL CAT B ISP country: IN admin-c: MT152-AP tech-c: MT152-AP status: ALLOCATED PORTABLE mnt-by: APNIC-HM mnt-lower: MAINT-IN-MTNL mnt-routes: MAINT-IN-MTNL remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+ remarks: This object can only be updated by APNIC hostmasters. remarks: To update this object, please contact APNIC remarks: hostmasters and include your organisation's account remarks: name in the subject line. remarks: -+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+ changed: hm-changed@apnic.net 20041130 changed: hm-changed@apnic.net 20081030 source: APNIC role: MAHANAGAR TELEPHONE address: Jeevan Bharati Building address: Tower 1, 12th Floor, 124, Connaught Circus, New Delhi country: IN phone: + 91-11-23766228 fax-no: + 91-11-23711266 e-mail: mgritco@bol.net.in e-mail: sdesys2@bol.net.in admin-c: NJ25-AP tech-c: SPS12-AP nic-hdl: MT152-AP mnt-by: MAINT-IN-MTNL changed: hostmaster@apnic.net 20081030 changed: hm-changed@apnic.net 20081030 source: APNIC Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1106874 Share on other sites More sharing options...
simsim Posted March 21, 2009 Share Posted March 21, 2009 I've seen this with Vuze on a real mac as well. It continues even if you stop all torrents. Here's an Apple Support thread that states it has to do with running BitTorrent software: Apple Support Here is another forum discussion on azureus and mach_kernel activity: http://forums.obdev.at/viewtopic.php?p=4253 Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1112106 Share on other sites More sharing options...
Scottapotamas Posted June 10, 2010 Share Posted June 10, 2010 sorry to bring up an old thread... but mine is doing it too... machine in sig... I don't need to run anything but just let it sit for 10mins or so... Ive been watching it closely and its being going to everywhere in asia, india, the us and germany... Ive lost 600mb or so of data through it... which is just a little concerning... Its a stock apple disk install... running a modified/hacked bios and only legacyhda.kext and disabler.kext... Anyone know what the hell its doing??? Link to comment https://www.insanelymac.com/forum/topic/109005-little-snitch-reports-mach-kernel-activity-during-transmission-use/#findComment-1485800 Share on other sites More sharing options...
Recommended Posts