Is this NETSTAT normal? Am I hacked?

Juice727 · Dec 10, 2015

Just curious if anything looks funny here, because my machine is running really slow and I have a weird feeling based on conversations with people on a website I frequent that I may have an issue...

Last login: Thu Dec 10 17:58:52 on console

J-MacBook-Air:~ J$ netstat

Active Internet connections

Proto Recv-Q Send-Q Local Address Foreign Address (state)

tcp4 0 0 192.168.1.7.49405 23.235.46.249.http ESTABLISHED

tcp4 0 0 192.168.1.7.49404 a23-201-103-137..http ESTABLISHED

tcp4 0 0 192.168.1.7.49403 a23-201-103-137..http ESTABLISHED

tcp4 0 0 192.168.1.7.49401 a23-201-103-137..http ESTABLISHED

tcp4 0 0 192.168.1.7.49402 a23-201-103-137..http ESTABLISHED

tcp4 0 0 192.168.1.7.49400 a23-201-103-137..http ESTABLISHED

tcp4 0 0 192.168.1.7.49399 a23-201-103-137..http ESTABLISHED

tcp4 0 0 192.168.1.7.49395 23.235.46.249.http ESTABLISHED

tcp4 0 0 192.168.1.7.49393 a23-4-43-27.depl.http ESTABLISHED

tcp4 0 0 192.168.1.7.49394 23.235.39.207.http ESTABLISHED

tcp4 0 0 192.168.1.7.49392 a23-202-46-224.d.https ESTABLISHED

tcp4 0 0 192.168.1.7.49391 a23-195-248-90.d.https ESTABLISHED

tcp4 0 0 192.168.1.7.49390 a23-14-84-162.de.http ESTABLISHED

tcp4 0 0 192.168.1.7.49388 192.168.1.78.commplex- SYN_SENT

tcp4 0 0 192.168.1.7.49387 17.249.137.246.https ESTABLISHED

tcp4 0 0 192.168.1.7.49383 17.249.137.246.https ESTABLISHED

tcp4 0 0 192.168.1.7.49382 17.249.137.246.https ESTABLISHED

tcp4 0 0 192.168.1.7.49380 17.249.137.246.https ESTABLISHED

tcp4 0 0 192.168.1.7.49249 17.172.239.43.5223 ESTABLISHED

tcp4 0 0 192.168.1.7.49245 17.110.227.99.5223 ESTABLISHED

tcp4 0 0 192.168.1.7.49244 mia07s27-in-f164.https ESTABLISHED

udp6 0 0 *.64902 *.*

udp4 0 0 *.64902 *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.64979 *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp46 0 0 *.* *.*

udp4 0 0 *.* *.*

udp6 0 0 *.mdns *.*

udp4 0 0 *.mdns *.*

udp4 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.netbios-ns *.*

udp4 0 0 *.netbios-dgm *.*

Active Multipath Internet connections

Proto/ID Flags Local Address Foreign Address (state)

icm6 0 0 *.* *.*

Active LOCAL (UNIX) domain sockets

Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr

9c5a9cc4fd25d6cd stream 0 0 0 9c5a9cc4fd25d08d 0 0 /var/run/mDNSResponder

9c5a9cc4fd25d08d stream 0 0 0 9c5a9cc4fd25d6cd 0 0

9c5a9cc4fc274985 stream 0 0 0 9c5a9cc4fc274b15 0 0

9c5a9cc4fc274b15 stream 0 0 0 9c5a9cc4fc274985 0 0

9c5a9cc4fd25dc45 stream 0 0 0 9c5a9cc4fd25d9ed 0 0

9c5a9cc4fd25d9ed stream 0 0 0 9c5a9cc4fd25dc45 0 0

9c5a9cc4fd25d605 stream 0 0 0 9c5a9cc4fd25d85d 0 0

9c5a9cc4fd25d85d stream 0 0 0 9c5a9cc4fd25d605 0 0

9c5a9cc4fd25d795 stream 0 0 0 9c5a9cc4fc2739e5 0 0 /var/run/mDNSResponder

9c5a9cc4fc2739e5 stream 0 0 0 9c5a9cc4fd25d795 0 0

9c5a9cc4fc272e2d stream 0 0 0 9c5a9cc4fc272ef5 0 0 /var/run/mDNSResponder

9c5a9cc4fc272ef5 stream 0 0 0 9c5a9cc4fc272e2d 0 0

9c5a9cc4fc2732dd stream 0 0 0 9c5a9cc4fc27346d 0 0 /var/run/mDNSResponder

9c5a9cc4fc27346d stream 0 0 0 9c5a9cc4fc2732dd 0 0

9c5a9cc4fc273c3d stream 0 0 0 9c5a9cc4fc273d05 0 0

9c5a9cc4fc273d05 stream 0 0 0 9c5a9cc4fc273c3d 0 0

9c5a9cc4fc273dcd stream 0 0 0 9c5a9cc4fc273e95 0 0

9c5a9cc4fc273e95 stream 0 0 0 9c5a9cc4fc273dcd 0 0

9c5a9cc4fc273f5d stream 0 0 0 9c5a9cc4fc274025 0 0

9c5a9cc4fc274025 stream 0 0 0 9c5a9cc4fc273f5d 0 0

9c5a9cc4fc2740ed stream 0 0 0 9c5a9cc4fc2741b5 0 0

9c5a9cc4fc2741b5 stream 0 0 0 9c5a9cc4fc2740ed 0 0

9c5a9cc4fc27427d stream 0 0 0 9c5a9cc4fc274345 0 0

9c5a9cc4fc274345 stream 0 0 0 9c5a9cc4fc27427d 0 0

9c5a9cc4fc27459d stream 0 0 0 9c5a9cc4fc2744d5 0 0

9c5a9cc4fc2744d5 stream 0 0 0 9c5a9cc4fc27459d 0 0

9c5a9cc4fc27472d stream 0 0 0 9c5a9cc4fc2747f5 0 0

9c5a9cc4fc2747f5 stream 0 0 0 9c5a9cc4fc27472d 0 0

9c5a9cc4fc274d6d stream 0 0 0 9c5a9cc4fc274bdd 0 0

9c5a9cc4fc274bdd stream 0 0 0 9c5a9cc4fc274d6d 0 0

9c5a9cc4fc274665 stream 0 0 0 9c5a9cc4fc27440d 0 0

9c5a9cc4fc27440d stream 0 0 0 9c5a9cc4fc274665 0 0

9c5a9cc4fc274fc5 stream 0 0 9c5a9cc4fa6e3c65 0 0 0 /var/folders/42/tk4fzpr17wn08mmmcr4dqty80000gn/T/chrome-cqLuGI/Socket

9c5a9cc4f91b4ef5 stream 0 0 9c5a9cc4fa66ae55 0 0 0 /var/folders/42/tk4fzpr17wn08mmmcr4dqty80000gn/T/.com.google.Chrome.9eiF38/SingletonSocket

9c5a9cc4f91b659d stream 0 0 0 9c5a9cc4f91b6665 0 0

9c5a9cc4f91b6665 stream 0 0 0 9c5a9cc4f91b659d 0 0

9c5a9cc4fc275925 stream 0 0 9c5a9cc4fc7583f5 0 0 0 /var/folders/42/tk4fzpr17wn08mmmcr4dqty80000gn/T/icssuis501

9c5a9cc4fc2759ed stream 0 0 0 9c5a9cc4fc275ab5 0 0

9c5a9cc4fc275ab5 stream 0 0 0 9c5a9cc4fc2759ed 0 0

9c5a9cc4fc275b7d stream 0 0 0 9c5a9cc4fc275c45 0 0 /var/run/mDNSResponder

9c5a9cc4fc275c45 stream 0 0 0 9c5a9cc4fc275b7d 0 0

9c5a9cc4f91b5085 stream 0 0 0 9c5a9cc4f91b514d 0 0 /var/run/mDNSResponder

9c5a9cc4f91b514d stream 0 0 0 9c5a9cc4f91b5085 0 0

9c5a9cc4f91b5215 stream 0 0 0 9c5a9cc4f91b52dd 0 0 /var/run/mDNSResponder

9c5a9cc4f91b52dd stream 0 0 0 9c5a9cc4f91b5215 0 0

9c5a9cc4f91b53a5 stream 0 0 0 9c5a9cc4f91b546d 0 0 /var/run/mDNSResponder

9c5a9cc4f91b546d stream 0 0 0 9c5a9cc4f91b53a5 0 0

9c5a9cc4f91b5535 stream 0 0 0 9c5a9cc4f91b55fd 0 0 /var/run/mDNSResponder

9c5a9cc4f91b55fd stream 0 0 0 9c5a9cc4f91b5535 0 0

9c5a9cc4f91b5855 stream 0 0 9c5a9cc4fbba0b75 0 0 0 /private/tmp/com.apple.launchd.w5qdNujO0z/Listeners

9c5a9cc4f91b6025 stream 0 0 9c5a9cc4fbb68d65 0 0 0 /private/tmp/com.apple.launchd.AkXEomzlBM/Render

9c5a9cc4f91b5f5d stream 0 0 9c5a9cc4fbb68f45 0 0 0 /var/tmp/filesystemui.socket

9c5a9cc4f91b672d stream 0 0 0 9c5a9cc4f91b67f5 0 0

9c5a9cc4f91b67f5 stream 0 0 0 9c5a9cc4f91b672d 0 0

9c5a9cc4f91b6ca5 stream 0 0 9c5a9cc4f9f216c5 0 0 0 /var/run/pppconfd

9c5a9cc4f91b6efd stream 0 0 9c5a9cc4f95783f5 0 0 0 /var/run/com.skype.skypeinstaller.socket

9c5a9cc4f91b6fc5 stream 0 0 9c5a9cc4f95784e5 0 0 0 /private/var/run/cupsd

9c5a9cc4f91b708d stream 0 0 9c5a9cc4f955fe55 0 0 0 /var/run/com.cyberghostsrl.CyberghostPrivilegedHelper.socket

9c5a9cc4f91b7155 stream 0 0 9c5a9cc4f950ff45 0 0 0 /var/run/usbmuxd

9c5a9cc4f91b721d stream 0 0 9c5a9cc4f9510b75 0 0 0 /var/run/systemkeychaincheck.socket

9c5a9cc4f91b72e5 stream 0 0 9c5a9cc4f94e9d65 0 0 0 /var/run/portmap.socket

9c5a9cc4f91b73ad stream 0 0 9c5a9cc4f94ea5d5 0 0 0 /var/run/vpncontrol.sock

9c5a9cc4f91b7475 stream 0 0 9c5a9cc4f94ae6c5 0 0 0 /var/rpc/ncacn_np/srvsvc

9c5a9cc4f91b753d stream 0 0 9c5a9cc4f94ae7b5 0 0 0 /var/rpc/ncalrpc/srvsvc

9c5a9cc4f91b7605 stream 0 0 9c5a9cc4f94ae8a5 0 0 0 /var/rpc/ncacn_np/wkssvc

9c5a9cc4f91b76cd stream 0 0 9c5a9cc4f94988a5 0 0 0 /var/rpc/ncalrpc/wkssvc

9c5a9cc4f91b7795 stream 0 0 9c5a9cc4f9498995 0 0 0 /var/rpc/ncacn_np/lsarpc

9c5a9cc4f91b785d stream 0 0 9c5a9cc4f9498a85 0 0 0 /var/rpc/ncalrpc/lsarpc

9c5a9cc4f91b7925 stream 0 0 9c5a9cc4f9498b75 0 0 0 /var/rpc/ncalrpc/NETLOGON

9c5a9cc4f91b79ed stream 0 0 9c5a9cc4f9488e55 0 0 0 /var/rpc/ncacn_np/mdssvc

9c5a9cc4f91b7ab5 stream 0 0 9c5a9cc4f94655d5 0 0 0 /var/run/mDNSResponder

9c5a9cc4f91b5e95 dgram 0 0 0 9c5a9cc4f91b5dcd 9c5a9cc4f91b5dcd 0

9c5a9cc4f91b5dcd dgram 0 0 0 9c5a9cc4f91b5e95 9c5a9cc4f91b5e95 0

9c5a9cc4fc2733a5 dgram 0 0 0 9c5a9cc4fc27314d 9c5a9cc4fc27314d 0

9c5a9cc4fc27314d dgram 0 0 0 9c5a9cc4fc2733a5 9c5a9cc4fc2733a5 0

9c5a9cc4fd25d53d dgram 0 0 0 9c5a9cc4fd25d475 9c5a9cc4fd25d475 0

9c5a9cc4fd25d475 dgram 0 0 0 9c5a9cc4fd25d53d 9c5a9cc4fd25d53d 0

9c5a9cc4fc27391d dgram 0 0 0 9c5a9cc4fc27378d 9c5a9cc4fc27378d 0

9c5a9cc4fc27378d dgram 0 0 0 9c5a9cc4fc27391d 9c5a9cc4fc27391d 0

9c5a9cc4fc272fbd dgram 0 0 0 9c5a9cc4fc273085 9c5a9cc4fc273085 0

9c5a9cc4fc273085 dgram 0 0 0 9c5a9cc4fc272fbd 9c5a9cc4fc272fbd 0

9c5a9cc4fc274a4d dgram 0 0 0 9c5a9cc4fc2748bd 9c5a9cc4fc2748bd 0

9c5a9cc4fc2748bd dgram 0 0 0 9c5a9cc4fc274a4d 9c5a9cc4fc274a4d 0

9c5a9cc4fc27508d dgram 0 0 0 9c5a9cc4fc275155 9c5a9cc4fc275155 0

9c5a9cc4fc275155 dgram 0 0 0 9c5a9cc4fc27508d 9c5a9cc4fc27508d 0

9c5a9cc4fc2753ad dgram 0 0 0 9c5a9cc4fc275475 9c5a9cc4fc275475 0

9c5a9cc4fc275475 dgram 0 0 0 9c5a9cc4fc2753ad 9c5a9cc4fc2753ad 0

9c5a9cc4fc27521d dgram 0 0 0 9c5a9cc4fc2752e5 9c5a9cc4fc2752e5 0

9c5a9cc4fc2752e5 dgram 0 0 0 9c5a9cc4fc27521d 9c5a9cc4fc27521d 0

9c5a9cc4fc275605 dgram 0 0 0 9c5a9cc4fc27553d 9c5a9cc4fc27553d 0

9c5a9cc4fc27553d dgram 0 0 0 9c5a9cc4fc275605 9c5a9cc4fc275605 0

9c5a9cc4fc2756cd dgram 0 0 0 9c5a9cc4f91b7c45 0 9c5a9cc4fc275795

9c5a9cc4fc275795 dgram 0 0 0 9c5a9cc4f91b7c45 0 9c5a9cc4fc27585d

9c5a9cc4fc27585d dgram 0 0 0 9c5a9cc4f91b7c45 0 9c5a9cc4f91b6a4d

9c5a9cc4f91b4d65 dgram 0 0 0 9c5a9cc4f91b4e2d 9c5a9cc4f91b4e2d 0

9c5a9cc4f91b4e2d dgram 0 0 0 9c5a9cc4f91b4d65 9c5a9cc4f91b4d65 0

9c5a9cc4f91b640d dgram 0 0 0 9c5a9cc4f91b64d5 9c5a9cc4f91b64d5 0

9c5a9cc4f91b64d5 dgram 0 0 0 9c5a9cc4f91b640d 9c5a9cc4f91b640d 0

9c5a9cc4f91b578d dgram 0 0 0 9c5a9cc4f91b56c5 9c5a9cc4f91b56c5 0

9c5a9cc4f91b56c5 dgram 0 0 0 9c5a9cc4f91b578d 9c5a9cc4f91b578d 0

9c5a9cc4f91b59e5 dgram 0 0 0 9c5a9cc4f91b591d 9c5a9cc4f91b591d 0

9c5a9cc4f91b591d dgram 0 0 0 9c5a9cc4f91b59e5 9c5a9cc4f91b59e5 0

9c5a9cc4f91b5aad dgram 0 0 0 9c5a9cc4f91b5b75 9c5a9cc4f91b5b75 0

9c5a9cc4f91b5b75 dgram 0 0 0 9c5a9cc4f91b5aad 9c5a9cc4f91b5aad 0

9c5a9cc4f91b5c3d dgram 0 0 0 9c5a9cc4f91b5d05 9c5a9cc4f91b5d05 0

9c5a9cc4f91b5d05 dgram 0 0 0 9c5a9cc4f91b5c3d 9c5a9cc4f91b5c3d 0

9c5a9cc4f91b60ed dgram 0 0 0 9c5a9cc4f91b61b5 9c5a9cc4f91b61b5 0

9c5a9cc4f91b61b5 dgram 0 0 0 9c5a9cc4f91b60ed 9c5a9cc4f91b60ed 0

9c5a9cc4f91b627d dgram 0 0 0 9c5a9cc4f91b6345 9c5a9cc4f91b6345 0

9c5a9cc4f91b6345 dgram 0 0 0 9c5a9cc4f91b627d 9c5a9cc4f91b627d 0

9c5a9cc4f91b68bd dgram 0 0 0 9c5a9cc4f91b6985 9c5a9cc4f91b6985 0

9c5a9cc4f91b6985 dgram 0 0 0 9c5a9cc4f91b68bd 9c5a9cc4f91b68bd 0

9c5a9cc4f91b6a4d dgram 0 0 0 9c5a9cc4f91b7c45 0 9c5a9cc4f91b7b7d

9c5a9cc4f91b6b15 dgram 0 0 0 9c5a9cc4f91b6bdd 9c5a9cc4f91b6bdd 0

9c5a9cc4f91b6bdd dgram 0 0 0 9c5a9cc4f91b6b15 9c5a9cc4f91b6b15 0

9c5a9cc4f91b6d6d dgram 0 0 0 9c5a9cc4f91b6e35 9c5a9cc4f91b6e35 0

9c5a9cc4f91b6e35 dgram 0 0 0 9c5a9cc4f91b6d6d 9c5a9cc4f91b6d6d 0

9c5a9cc4f91b7b7d dgram 0 0 0 9c5a9cc4f91b7c45 0 0

9c5a9cc4f91b7c45 dgram 0 0 9c5a9cc4f918b5d5 0 9c5a9cc4fc2756cd 0 /private//var/run/syslog

Registered kernel control modules

id flags pcbcount rcvbuf sndbuf name

1 9 0 131072 8192 com.apple.flow-divert

2 1 1 16384 2048 com.apple.nke.sockwall

3 9 0 524288 524288 com.apple.content-filter

4 9 0 8192 2048 com.apple.packet-mangler

5 1 1 65536 65536 com.apple.net.necp_control

6 9 0 524288 524288 com.apple.net.utun_control

7 1 0 65536 65536 com.apple.net.ipsec_control

8 0 11 8192 2048 com.apple.netsrc

9 18 0 8192 2048 com.apple.network.statistics

a 5 0 8192 2048 com.apple.network.tcp_ccdebug

Active kernel event sockets

Proto Recv-Q Send-Q vendor class subcla

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 1 2

kevt 0 0 1 1 10

kevt 0 0 1001 5 11

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 6 1

kevt 0 0 1 1 2

kevt 0 0 1 1 1

kevt 0 0 1 1 2

kevt 0 0 1 6 1

kevt 0 0 1 1 0

Active kernel control sockets

Proto Recv-Q Send-Q unit id name

kctl 0 0 1 2 com.apple.nke.sockwall

kctl 0 0 1 5 com.apple.net.necp_control

kctl 0 0 1 8 com.apple.netsrc

kctl 0 0 2 8 com.apple.netsrc

kctl 0 0 3 8 com.apple.netsrc

kctl 0 0 4 8 com.apple.netsrc

kctl 0 0 5 8 com.apple.netsrc

kctl 0 0 6 8 com.apple.netsrc

kctl 0 0 7 8 com.apple.netsrc

kctl 0 0 8 8 com.apple.netsrc

kctl 0 0 9 8 com.apple.netsrc

kctl 0 0 10 8 com.apple.netsrc

kctl 0 0 11 8 com.apple.netsrc

J-MacBook-Air:~ J$

dogslobber · Dec 11, 2015

What does "lsof -i" and "netstat -an | grep LISTEN" show?

cerberusss · Dec 12, 2015

dogslobber said:
What does "lsof -i" and "netstat -an | grep LISTEN" show?

Before moving to OS X, I was a Linux user. And comments like these make me feel warm and fuzzy and all at home 🙂

flashy-cat · Dec 12, 2015

R.I.P. Juice727

dogslobber · Dec 12, 2015

cerberusss said:
Before moving to OS X, I was a Linux user. And comments like these make me feel warm and fuzzy and all at home 🙂

I suppose 'sudo lsof -i' is better to show what the kernel apps are doing to. Can't remember offhand.

theSeb · Dec 12, 2015

Is this what you see when a browser is running?

Les Kern · Dec 12, 2015

Juice727 said:
Just curious if anything looks funny here

Quite literally... nothing.
Some IP's are Apple, for things like push notifications.
You'll need to look elsewhere for your issues of a slow OS.

Search

Search

Is this NETSTAT normal? Am I hacked?

Juice727

macrumors newbie

dogslobber

macrumors 601

cerberusss

macrumors 6502a

flashy-cat

macrumors regular

dogslobber

macrumors 601

theSeb

macrumors 604

Les Kern

macrumors 68040

Our Staff