Endlessly downloading nothingness....

Discussion in 'macOS' started by OutThere, Oct 3, 2006.

  1. OutThere macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #1
    I have no idea what is going on with my computer. It is constantly downloading something, from somewhere, apparently without saving it to the hard drive or anything (no HD activity), with no applications open.

    It seems to be running pretty much at the max speed of my internet (college internet speed varies depending on the time of day), so it can be anywhere from 300 KB/s to more than 1 MB/s (my computer hates that).

    It comes back after restarting, though I haven't observed it closely enough to see exactly how/when it comes back. It's there whether or not I have apps open. It seems to be generating anywhere from 10-30% processor use as well, depending on how fast it's going.

    Gahhhhhhhhhhhhhh! :rolleyes:
     

    Attached Files:

  2. Foxglove9 macrumors 65816

    Foxglove9

    Joined:
    Jan 14, 2006
    Location:
    New York City
    #2
    That happens to me sometimes too, I thought it was Safari doing it but it's not.

    When I do a restart it is fine.
     
  3. mad jew Moderator emeritus

    mad jew

    Joined:
    Apr 3, 2004
    Location:
    Adelaide, Australia
    #3
    So are you on a college network? Could it be file sharing or iTunes music sharing?
     
  4. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #4
    Yes I am on a college network, but I have all of my file sharing services off, and it keeps up even with iTunes closed. It also continues on the college's wireless network, making it so that I have absurdly little battery life.

    Also, little snitch reports nothing on 'Deny All', and even with ethernet and airport off/unplugged it continues to download at 8KB/s (I don't know how that works).
     
  5. knome macrumors 6502

    knome

    Joined:
    Sep 7, 2006
    #5
    i have that same problem, except that i am uploading stuff as well. i am also on a college network. But they have the internet here locked down so tight its not even funny so i don't think its some computer out there. I've looked under windows and it is not downloading anything. Here's a pic.

    [​IMG]
     
  6. iMeowbot macrumors G3

    iMeowbot

    Joined:
    Aug 30, 2003
    #6
    A couple places you can look to see what is going on with the network:

    In Network Utility, you can use Netstat. (the netstat command is also available from the terminal, try netstat -f inet to trim the output to the generally interesting parts)

    Also from terminal, lsof -i can give an interesting view of what is connecting where. Prefix that with sudo (password prompt will follow) to see everything, not just your own processes.
     
  7. Passante macrumors 6502a

    Passante

    Joined:
    Apr 16, 2004
    Location:
    on the sofa
    #7
    Did you upgrade to the latest iTunes. It could be cover art downloads.

    I suggest you download Little Snitch. It monitors all communication from your computer and will tell you whats talking to what.
     
  8. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #8
    Thanks for the advice, especially the terminal advice iMeowbot.

    I have updated iTunes to v7, but it already went through its album art process, and the downloading continues regardless of iTunes being open or closed.

    As to Little Snitch, I turned it on (demo mode which is supposed to be fully functional), set it to Deny All and it didn't report any attempts at network connections.

    I've attached my netstat results, which seem to show activity under the processes "*.mdns", which seem to be receiving something constantly. I tried force-quitting the mDNSResponder process in the terminal (which, incidentally uses a significant amount of processor), which caused the network activity to spike suddenly and then drop off to 0 for just a moment before the process came back. I'm pretty sure that that's the problem...but what is it doing, and how do I fix it?
     

    Attached Files:

  9. 2nyRiggz macrumors 603

    2nyRiggz

    Joined:
    Aug 20, 2005
    Location:
    Thank you Jah...I'm so Blessed
    #9
    I was going to ask you about any FTP or bittorrent apps but you already stated they are closed...its got to be something on that network...have you try taking your laptop to a cafe and see if you get that same spike?


    Bless
     
  10. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #10
    mDNS is multicast DNS and is the source of Bonjour/Rendezvous activity.
    It's poling for printers, computers, and other devices.

    As iMeowbot said, you should try using lsof to find the culprit.
     
  11. The General macrumors 601

    Joined:
    Jul 7, 2006
    #11
    You aren't playing music from iTunes through Airtunes are you?
     
  12. iMeowbot macrumors G3

    iMeowbot

    Joined:
    Aug 30, 2003
    #12
    Just a hunch: turn off the sharing stuff in iTunes to see what happens. In a campus environment, there are going to be people looking for shared playlists constantly.
     
  13. Sweetfeld28 macrumors 65816

    Sweetfeld28

    Joined:
    Feb 10, 2003
    Location:
    Buckeye Country, O-H
    #13
    Folding wouldn't have anything to do with it owuld it?

    I have noticed a couple of times that the computer that i have running folding@home on, would take a while to download some files sometimes. I have it running on an AMD 64 bit computer.

    Just a guess.
     
  14. knome macrumors 6502

    knome

    Joined:
    Sep 7, 2006
    #14
    it doesn't have anything to do with itunes because i showed i had the same problem but my itunes isn't open. Neither do i have bit torrent open, or any internet application.

    Now that i think about this i had this problem on my g4 like a year ago(home network), never could figure out what it was and eventually i just gave up.
     
  15. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #15
    I think I can definitely rule out iTunes/file sharing as it continues just as much with iTunes closed, and with iTunes open with sharing both on and off, and with my file sharing protocols on and off, plus I don't have folding@home.

    I ran lsof and netstat at the same time, with no apps open other than activity monitor and the terminal, but I'm not sure how to interpret the results (attached). Note the disproportion between the upload and download/packets in/out totals in the activity monitor.

    If it means anything, with ethernet on DHCP IPv4 it runs full blast, when IPv4 is off, and only IPv6 is on it runs at like 10-15 kB/s and with IPv6 and IPv4 are both off, it stops altogether.
     

    Attached Files:

  16. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #16
    Makes me wonder if it's registering the connections to localhost as upload/download. How to check?

    Pull your network connection. Still getting up/down traffic? Then it's localhost.

    EDIT: Just testing it..

    Turned off all my network connections and I was still getting data received traffic, which means it's localhost traffic.

    99.9999% likely this is what you're seeing.
     
  17. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #17
    damn. you had me excited....until I pulled my ethernet. doh! :cool:

    If pictures tell 1000 words, you should be able to see right where I pulled the ethernet:

    edit: the behavior is repeatable...it flatlines for as long as the ethernet is out, and I also repaired permissions (again) in the mean time.
     

    Attached Files:

  18. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #18
    Odd.. guess I hit the .0001% wall there. :)

    Well you can always install ethereal with fink and sniff all the network traffic for a bit.

    Frankly, I don't see anything in the the lsof or netstat output that would alarm me too much.
     
  19. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #19
    Done...but after my fantasy hockey draft. :D
     
  20. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #20
    Ok. So I installed ethereal (awesome app btw), sniffed packets for a little bit and then let it analyze what had come and gone...so apparently it's entirely MDNS "Standard Query" and then "Standard Query Response" from other people's shared iTunes on the network, and computer names ending in .local, regardless of whether I have iTunes open or any sort of sharing open.

    Each query and response is a few hundred bytes, and thousands upon thousands go through every second, so that's where the bandwidth comes in, by why in the hell is my computer being wtfpwned by all the other macs/iTunes on my network!?

    I'm close to just blocking port 5353 (mdns) from all traffic. Maybe that would do the trick?
     
  21. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #21
    Just know if you do that, you can't use Bonjour to find devices/shares on your network.

    What if you explicitly turn off iTunes sharing in iTunes? Are you sure it's not Bonjour enabled iChat query/responses that are also being added, or what it clearly iTunes related in the packets?
     
  22. OutThere thread starter macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #22
    Well it appears that renaming the /usr/sbin/mDNSResponder to mDNSResponder.bak and force quitting it from the activity monitor solved the problem. Granted I have no bonjour services right now, but my processor does idle at 0% instead of 30%, and I can video chat properly without weird choppy lag.

    I guess I'll find out quickly what apps rely on bonjour (I've heard there are some), and bonjour will have to wait until my next system reinstall.

    There does still seem to be an 8-10k/s trickle coming in but I don't know where it's coming from and when I launch ethereal something starts generating mDNS queries again....so I can't isolate what exactly is causing the continued data, but I honestly couldn't care less, as my computer actually works right now.

    In conclusion: my computer hates me. :p

    edit: it seems that more computers than just mine are doing this. I just checked my roomies ibook and, lo and behold, it's cranking away at 400k, as are a couple other macs around.

    The question there is: where's the bug? Maybe I should talk to IT.
     
  23. yellow Moderator emeritus

    yellow

    Joined:
    Oct 21, 2003
    Location:
    Portland, OR
    #23
    You can turn off Bonjour in /Applications/Utilities/Directory Access.app
     

Share This Page