All of a sudden, I'm getting all sorts of new connections

[Mr Birdie]

In the past week or two, I've been getting all sorts of new connection requests from Little Snitch. These are requests like I have never seen before. I have been running Little Snitch for quite some time, but I am getting requests from applications that have not asked for anything in a long time, or perhaps ever. for example, I am getting requests form Text Edit, which as far as I can remember, never asked for anything before, or not for a long time. And the funny thing is, recently is the first time I've ever seen requests to IPv6 addresses. Almost all of the new connections are IPv6 addresses. For example, the requeat I just got from Text Edit is a request to 2002:44e:17f2::21b:63ff:fe04:28a1. this is the first time I have ever seen Little Snitch request to connect to an IPv6 address. Its not just Text Edit, though. I am getting requests from just about every application I run, applications I have been running for a long time, long since I've started running Little Snitch. There are two variables that I have introduced, I'm wondering if they have something to do with it. I recently installed ESET Cybersecurity and Firefox 4. I normally don't introduce two new pieces of software at the same time, but I didn't think these two would be an issue. Firefox 4 has introduced a whole new set of requests for plugin-container. I looked that up and know it's a new feature with Firefox, so I'm not too worried, but the other ones I'm getting are really worrisome. I am starting to wonder if I might have a trojan that is calling from all these applications, but I'd like to think ESET Cybersecurity is protecting me from that. So, is there any other reason that I would be gaining all sorts of new connections, and in new formats like I've never seen before? I'm freaking out a little!

[manfred]

Do you know if anything changed in the way you accessing the internet? For example a new wi-fi router?

I think this could be a reasonable explanation for the IPv6 connections.

[Mr Birdie]

Do you know if anything changed in the way you accessing the internet? For example a new wi-fi router?

I think this could be a reasonable explanation for the IPv6 connections.

Well, I did get a new router, but it's been at least a month since I got that, and these new connections have been all in about the past 12 days. Probably about since the time I installed ESET.

One more thing that popped up at about the same time is the appearance of connections to "mpsnare.iesnare.com". I think it may have originated from oDesk.com, because it comes up every time I connect there. But I don't understand how that would have anything to do with all these new connections I'm seeing. Is it really normal for Text Edit to connect to anything? I have never seen that until now.

[manfred]

Is it really normal for Text Edit to connect to anything? I have never seen that until now.

TextEdit sometimes comes up with strange connection attempts. For example if you open a html file in TextEdit (as plain text) it obviously follows some links in this html file (which is of course not necessary).

Luckly Little Snitch detects the culprit

[CyberStealth]

Wow I just came here because I seen good old Little Snitch had been updated
and then I stumbled came across this post...

Now I know I'm not going crazy, I'm with you in this issue.
I have been a Little Snitch users now for years with everything
running smoothly, nothing unusual, no surprises.

Now as of recently all sorts of standard apps started behaving, in my opinion strangely.
Apps as far as I recall never acted this way before.
So I started monitoring all them more closely and wondering why
any internet connection would be necessary in the first place?

At first I allowed them to connect but it bothered me as to why this was mysteriously
occurring in the first place, yet I was worried it just might be part
of the Apple system and I didn't want to muck anything up...

In the end I still don't think it's normal behavior for these standard apps
to be behaving this way so I went ahead and just blocked them all for good.
Which I honestly think actually improved my overall system performance.
Perhaps now I can finally get some answers to what exactly is going on?

Here's a list of apps that started acting weird, these alerts never occurred prior.
Which really makes me wonder, why all of a sudden now but never before?
I know there are more but all this seems strange to me.

Address Book - (why?)
bash - (huh?)
Calculator (neat.)
configd - (what?)
Disk Utility - (ok?)
Finder - (really since when? MOST ACTIVE!)
nmbd - (very active.)
TextEdit - (would ONLY happen when saving.)
System Preferences - (only has happened once.)

Also:
mDNSResponder has a 11 ports listening and
ntpd has four ports listening.
PubSub is acting up again as well. (just updated safari/itunes)

Well hopefully someone can provide real answers here.
all my research "g gle" has come up with nothing.

[manfred]

Address Book - (why?)
bash - (huh?)
Calculator (neat.)
configd - (what?)
Disk Utility - (ok?)
Finder - (really since when? MOST ACTIVE!)
nmbd - (very active.)
TextEdit - (would ONLY happen when saving.)
System Preferences - (only has happened once.)

Please show me some example screenshots what the connections look like. If the screenshots contain confidential information, feel free to contact us via email.

[derryck]

Same here - various apps asking for connections to eg my NAS drive. I've been setting these requests to "Alway Allow", so I can't now say which these are until some more occur.

I suppose I could roll back the rule set with Time Machine?

This does seem to be a problem with LS 2.3.5 or maybe OS 10.6.7.

[hagen]

I suppose I could roll back the rule set with Time Machine?

No need to do anything so drastic. You can disable rules in the rules screen.

This does seem to be a problem with LS 2.3.5 or maybe OS 10.6.7.

I don't think it's OS 10.6.7, as I see no increase in activity. I am still using LS 2.3.3 though, if that means anything.

[Stimper]

No further fixes to the problem of new connection requests? I've recently encountered this issue..

[clarajames]

That's good but have you noticed any thing which is not good or creating some damages.