Browser connects to my own IP on first forum visit

uli · 2015-04-29 14:43:37

After opening an internet connection, on the first visit of this forum, Little Snitch (a Macintosh control panel for incoming/outgoing internet connections) tells me that my browser wants to connect to numeric IP addresses that can’t be resolved any further. It turned out that these are always my own IPs.

Where is the sense in connencting to these?
And why is this happening only on the Textpattern forum?

ruud · 2015-04-29 16:45:40

Install WireShark and find out what’s really happening :)

uli · 2015-04-29 17:15:36

OK, Wireshark is installed, but now it wants X11 in order to run. I’m always a little cautious to install interdependent applications that come as package installers (as opposed to one chunk apps): Where do they go? Will they leave my system stable? Hence: Is what I described above something to be vigilant, is it worth the risk of an unstable system? I posted rather out of curiosity.

ruud · 2015-04-29 21:23:30

There are probably other ways to do this:
Does little snitch tell you which port numbers are used?
Which IPnr is it connecting to? 127.0.0.1 or some private range IP or a public IP?
Have you tried using the network debugging tools built into your browser?

phiw13 · 2015-04-29 23:48:02

Uli — what OS are you running? X11.app is installed by default on 10.9 and 10.10 (in /Applications/Utilities/). And yes, it is a “safe” thing to have installed.

Depending which browser you use, do you have extensions or scripts (AppleScript?) that are active only for this forum, and connect to localhost or similar?

For other ways of debugging, try this article, or Cocoa Packet Analyzer (linked in that article). I haven’t used LittleSnitch for ages.

uli · 2015-04-30 13:29:10

Thanks, Ruud and Philippe!

ruud wrote #290294:

Does little snitch tell you which port numbers are used?
Which IPnr is it connecting to? 127.0.0.1 or some private range IP or a public IP?

It asks for a connection to numbers like 91.0.45.40 (which back then was my own, as seen on utrace.de) on port 80.

Have you tried using the network debugging tools built into your browser?

I’ll try to remember to open the first connection with the tools already opened. Unfortunately I didn’t yet find a way to trigger the described behaviour intentionally.

phiw13 wrote #290295:

Uli — what OS are you running? X11.app is installed by default on 10.9 and 10.10 (in /Applications/Utilities/).

I’m on 10.8. I tried downloading XQuartz yesterday but had no luck with a stable connection within several hours.

Depending which browser you use, do you have extensions or scripts (AppleScript?) that are active only for this forum, and connect to localhost or similar?

Nothing specially for this forum, no. My everyday browser is FF, I can’t recall seeing the Little Snitch behaviour on other browsers. I’ll have to experiment with deactivated addons, but like I said I didn’t succeed in triggering that behaviour (e.g. deleting that temporary Snitch rule and reloading a forum page, or closing the connection and retrying. Note to myself: Maybe shutting down FF and everything I mentioned previously?).

For other ways of debugging, try this article, or Cocoa Packet Analyzer (linked in that article).

I’m totally wireless-less ;)

Textpattern CMS

Textpattern CMS support forum

#1 2015-04-29 14:43:37