Strange firewall event log messages

[zanglebert]

Hey everyone

I already asked more or less the same question on the "official" mac forum, but the answers I got there were very unhelpful and pretty unfriendly as well. Maybe someone in here can help me out?

I just started using the application firewall TCPBlock to log outgoing connections. Most of the output as shown in Console looks like this:

7/10/14 18:49:02.000 kernel[0]: tcpblock: allow connection of uTorrent to 88.123.8.213:61837 uid=501 pid=1795 proto=6

7/10/14 18:49:03.000 kernel[0]: tcpblock: allow connection of firefox to 127.0.0.1:12080 uid=501 pid=1989 proto=6

Note that I'm allowing all outgoing connections, I just want to get an overview of what the connections are.

There are also the following events in between:

7/10/14 18:49:07.000 kernel[0]: tcpblock: allow connectcptionblock: of c aomllow connect.aion of cvast.promoxy t.avaso t.proxy t194.221o 1.65.23:80 u94.2id=0 pid2=889 proto=6

7/10/14 18:51:02.000 kernel[0]: tcpblock: tcallow connection of upblockTorr: allow connectenion oft fro uTorrent m 192.168.2.2:58240 uid=501 pid=1795to 70 p.189roto=6

7/10/14 18:53:32.000 kernel[0]: tcpblock: allow accept from 127.0.0.1:tcpblock: 584all50 toow c coonnection of com.m.avast.avast.proxypr to oxy uid=0 pi205.185d=889 proto=6

They look like tcpblock events as well, but seem to be permutations or garbled up versions of the above events. Anyone knows what's behind this? Maybe related to avast, which at least in some of the events is mentioned as well (though not in all of them).

Two remarks: 1) Can I please not get a moral lecture on torrenting? I am using it for entirely legal purposes. 2) I know, I have avast installed. I made that as a conscious choice, I know some Mac users are against AVs, but I hope I won't only get one line answers of the type "uninstall Avast". Yeah, in case you're wondering, the two remarks are the result of the reactions on the official forum :/

 

[DeltaMac]

...
I already asked more or less the same question on the "official" mac forum, but the answers I got there were very unhelpful and pretty unfriendly as well. Maybe someone in here can help me out?

I just started using the application firewall TCPBlock to log outgoing connections. Most of the output as shown in Console looks like this:
...
Note that I'm allowing all outgoing connections, I just want to get an overview of what the connections are.
…
They look like tcpblock events as well, but seem to be permutations or garbled up versions of the above events. Anyone knows what's behind this? Maybe related to avast, which at least in some of the events is mentioned as well (though not in all of them).

Two remarks: 1) Can I please not get a moral lecture on torrenting? I am using it for entirely legal purposes. 2) I know, I have avast installed. I made that as a conscious choice, I know some Mac users are against AVs, but I hope I won't only get one line answers of the type "uninstall Avast". Yeah, in case you're wondering, the two remarks are the result of the reactions on the official forum :/

Maybe someone in here can help me out?

Not enough facts to give an answer…

Anyone knows what's behind this?

As you are looking at your TCPBlock logs - can you disable or uninstall TCPBlock, then check in your system.log to see if other types of events show the same garbled output? Could be simply a bug in TCPBlock.

As you also mentioned Avast,
try disabling or uninstalling THAT, then watch your logs. (What's wrong with a one line answer? I hit return, so you would get a two-line answer )

Can I please not get a moral lecture on torrenting?

I don't know how to answer this question I have never heard of an "entirely legal purpose" for torrenting. That, imho, is something of an oxymoron. And, not a lecture, just my opinion.

 

[zanglebert]

Haha, thanks DeltaMac, I'll try your suggestions.

As for legal torrenting... how about

http://releases.ubuntu.com/14.04/ubuntu-14.04-server-amd64.iso.torrent

just as an example.

 

[DeltaMac]

And, my example….
I do occasionally use a torrent process for downloading something specific, but I don't leave that process available to others. I only use when I need it, otherwise, I uninstall the torrent software. Maybe that's somewhat hypocritical on my part, but then I may go two years between torrents. I believe that the torrent app is a completely unnecessary resource drain - when you aren't actually using it.