Constant Network Activity Showing With Airport & Bluetooth Off

[PGB1]

Hi All!
Activity Monitor always shows network traffic as packets being sent & received. I can't figure out how to stop the network traffic.
(One MacBook Pro is using 10.6.8 & one is using 10.11.4)

What Made Me Notice This?
I have constant network traffic showing in Activity Monitor and I think that is causing both of our computers not to log off while sleeping. They will sleep & the monitors will turn off, they just don't log out.

System preferences is set to Log Out after xx Minutes.
Mail is off. Browsers are closed.
Automatic Log In is off.
I shut down my printer which is connected to the modem by wire, but the modem is wireless.
I stopped the CrashPlan backup engine.
I made sure Bluetooth is off. (We don't own any Bluetooth devices.)
The modem for my network is in 'stealth' mode so people can't see it out in the wild.
'Wake For Ethernet' is not checked (it's off).

I figured turning Airport off surely would stop the packets. I was wrong.

I also tried SMC & PRAM resets.
The network still shows packets being sent & received.

Do any of you know what is causing packets to be sent & received when all this stuff is off?
Do you think the traffic is the reason for not logging out when sleeping for xx minutes?

Thanks For Helping!
Paul

A side note to mention, that I don't think is related to the constant network traffic, is that the 10.11.4 computer freezes when it sleeps. Only a prolonged press of the power button will free it by re-booting. That started when I installed the new SSD. (If OWC can't figure it out, I apologize but I'll be pestering you all with another forum question. So far they haven't found a solution to the freeze, but I have faith.)

 

[MacInWin]

If your WiFi is on on the MBPs, and if a neighbor, or someone driving by your home, has a WiFi device that is searching for an access point, your WiFi will identify itself and then deny access. That identification and denial takes a few packets. In fact, the two Macs may well be pinging one another if you have the Airport off, as they are also looking for an access point. Unless the traffic becomes more than a few trivial packets per second, you probably don't have much to worry about. If you really want to know, Little Snitch is a third party network monitor that will tell you what's going on. And I don't know what you mean by "not to log off while sleeping," unless you mean that they are not disconnecting from the Airport. That connection being maintained is normal, and how it is designed to work. Also, sleeping doesn't log out the user, although on wake up it may well ask for the login again for security, the user is not technically logged out of the account in sleep mode.

None of that should be impacting the failure to wake, but I have noted that because I have a lot of external drives attached normally (currently 6), wake up is slow as the OS checks each drive to make sure it is available before giving me the login prompt.

 

[PGB1]

Thanks for taking the time to reply with good information MacInWin.
What you wrote was a surprise to me. I always thought, apparently incorrectly, that when the modem was set to Stealth Mode neighbors & people driving by computers could not even see it, let alone ping it. If I turn the airport off, my computer doesn't see it so I manually enter the name of the network. Guess I was way wrong on that one! I also thought that if Airport was off there would be no traffic on the network. Oops!

By "not log off when sleeping" I was referring to System Preferences - Security where I can set the computer to "Log Off After 5 (or whatever) Minutes Of Inactivity".
In 10.11.4 it is under the Advanced tab & 10.6.8, it's on the main security page.
When I set the box to, for example, log off after 30 minutes of inactivity I thought the computer would be at the Log In screen when I woke it up (assuming it woke up).
When it wakes up, it is on the logged in user's last page. (This is when it wakes up OK. It's been having problems waking up since the new SSD.)

OWC just replied & asked me to remove the drive from the computer & connect it in as external enclosure and boot to it. Then, I will let it sleep & see if it still locks up the computer. If so, it is the fault of the new SSD. If not, it is the computer's fault. So I'll give it a go & see what happens.

Thanks Again for the good information!
Paul

 

[pm-r]

I dare say PGB1 , I think you'll find what you and I also understood was correct…

i.e.:
"… With Stealth Mode enabled, the Mac will not acknowledge or respond to typical network discovery attempts with ICMP ping requests, and will not answer connections attempts made from closed TCP and UDP networks. Essentially, it makes the Mac appear to these requests as if it doesn’t exist at all. …"
http://osxdaily.com/2015/11/18/enable-stealth-mode-mac-os-x-firewall/

And lots more with a google search…

 

[MacInWin]

Two thoughts, First, the OP said:

The modem for my network is in 'stealth' mode so people can't see it out in the wild.

That stealth mode is the Modem, or WiFi router, not the Mac. He didn't say the Mac itself was in stealth mode, so it's going to be questing for an access point.

Second, From that same article:

While this blocks most of the common network finding methods, a particularly savvy individual could still discover the Mac if they really wanted to, whether with a targeted packet capture, through a connected router, or a variety of other methods. This is why it’s called Stealth Mode and not Definitively Invisible Mode, because while it’s certainly going to be under the radar from common finding attempts, it can still be uncovered by a dedicated technical search particularly if that someone is on the same network.

So there are still packets in and out, even in stealth mode. The only way to have zero packets is to turn off WiFi and disconnect Ethernet and turn off Bluetooth. But the packets that are in and out, when in stealth or not, are still very, very few. I'l seeing 3-5 every 5 seconds or so on mine.

 

[pm-r]

Good catch Jake. And some differences when one delves into the details…

PS: I think this must be the first time I've ever even bothered to look at any of the Network tab stuff in my Activity Moniitor and even noticed what might be going on… ever…

 

[MacInWin]

I do keep an eye on the Network tab of Activity Monitor, just to see what is happening. Since any security breach is going to involve network traffic that I don't expect, it's sort of a "canary in the mine" alert system.

 

[PGB1]

Thank You guys for taking time to reply & explain stuff. I sure appreciate it.

Discussions like this one is just one on the many reasons I enjoy Mac-Forums. Add to that the fact that this is a really friendly place. No one gets beat up on for not knowing something. I learn a lot here about all manner of topics.
Any day that I get to learn something new is a very good day! Today I learned why I need a root canal & crown- Maybe that particular knowledge doesn't quite qualify for 'good day' learning. (So much for the New Computer fund!)

To make sure I understand correctly and didn't get stuff backwards:
A) When the modem is in Stealth Mode and the computer's Airport & Bluetooth are off, the computer's still sending & receiving the packets in & out that I see in Activity Monitor.
B) Those packets are random & harmless if I am at home & not on public WiFi
C) To stop all packets, I would have to put the computer's firewall in Stealth Mode, as explained in the article pm-r linked.
D) The computer doesn't have WiFi to turn off, it uses the WiFi the modem/router supplies by using the Airport card to talk to the router/modem.

I apologize if I have what you guys said all goofed up. I am heavy-duty dyslexic and often get things upside down & backwards. You should see me try to play basketball or do a jigsaw puzzle. It's quite comical!

I enjoyed reading the article you linked, pm-r, and saved it for future reference when I forget what I learned today. (Every time I learn something new, something old falls out. Age, I guess.)

A Side Note-
About the computer not logging off when it slept, I think I have that one figured out. I kinda-sorta had things backwards.
In System Preferences, under the Energy & the Security panes, I had it set so the computer logged out after it slept. Going to sleep didn't seem to let it log out.
An Example- Put Computer to Sleep was 5 minutes & Log Out was 10. It would sleep and waking it would reveal that it was still logged in. So I guess it fell asleep before it had a chance to log out. Kind of like falling asleep before parking the car.
When I flipped them- Log out before sleeping, it logged out. Then, I assume it went to sleep because the display went blank. Waking it brought me to the log in screen.
Simple, but elegant- I hope....

Thanks Again Guys!
Paul

 

[MacInWin]

Most of all, "OUCH" for the root canal and crown. Been there, done that. Fortunately, with sufficient painkiller, the process is not really that painful, just annoying.

D) The computer doesn't have WiFi to turn off, it uses the WiFi the modem/router supplies by using the Airport card to talk to the router/modem.

Really? I thought that MBP had internal WiFi. Apple says it has an internal WiFi, if it's the one in your profile. See here: https://support.apple.com/kb/SP24?locale=en_US
How is it connected to your modem/router? Maybe I'm misunderstanding your network topology. I was presuming that by "modem" you were referring to the interface box to your ISP, whatever that may be (Cable company, Dedicated ISP, DSL, telephone, whatever). Most of the time that "modem" is also a WiFi Server, to which the MBP connects by WiFi. If that is correct, turning on the stealth mode in the "modem" does, in fact, hide the network (sort of) but unless the MBP itself is in stealth mode, you will be sending out packets in search of a connection or if you are connected, in actual communication. And even in stealth mode, there will be SOME traffic. Zero packets is only achievable by turning off WiFi as I said.

And if the network description I gave is what you meant, then you will see those packets on the MBP under Activity Monitor because that app looks at packets in/out of the MBP, irrespective of what goes in/out of the "modem." In fact, if you put a sniffer on the connection from the "modem" to your ISP, you'd see tons of traffic on that side, even with zero connections on your network side, because that "modem" is in constant communication with the "mother ship" at the ISP.

 

[lclev]

PGB1

When the wireless airport that is in the computer is turned of and the bluetooth in the same computer is turned off - there will be no NEW network activity showing in the activity monitor. You have shut off all the networking devices on the computer.

Now as to your modem that brings in the internet to your home - if it is on and enabled it will have traffic even if stealth mode - with devices OTHER than your computer that has it's wireless airport adapter and bluetooth turned off. Also there will be no network activity showing in that computer's activity monitor. Look in Activity monitor on the right corner under Date Received and Data Sent. Those will show the most recent activity and they will eventually zero as it is shut off. Also the middle bottom of the window Packets will eventually flat line.

Hope that clears it up!

Lisa

 

[PGB1]

Hi Lisa & Jake

Thanks for the explanations. I must have my terminology all goofed up.
Lisa cleared up what I didn't understand- That Airport is the WiFi in the computer itself, as shown in the page Jake linked. (Cool page to save, by the way. Thanks Jake)

The network set up we have is a cable from the TV company that splits off on its way to the TV set & goes to a device they call a router/modem. It is connected by ethernet cable to the printer. It connects wirelessly to the 2 computers. There aren't any smart TVs or TV recording boxes, like one has with premium channels. We do have a digital adapter, however since our tv set has an analog tuner.

Here's my Big-Ol' Science Project-
Turned off the other computer.
Turned off the printer & unplugged the ethernet cable, the unplugged the printer from the wall outlet.
Put the computer's firewall into Stealth Mode
The modem is already in Stealth Mode.
Made sure Bluetooth is off in the computer.
Turned off Airport on the computer.
We have no bluetooth or wifi enabled devices, old geezers that we are.
Turned off the CrashPlan backup service & its 'engine", as the company calls the background stuff that drives the application.
Time Machine is also off.
For fun, I unplugged the cable going to the TV sets, so the only cable that's hooked to anything is to the modem.
As far as I can tell, the only application that was running was Activity Monitor.

As you both mentioned, I do see activity lights on the modem itself going on & off. The lights were much more 'busy' until I unplugged the ethernet cable to the printer.
Thanks guys for the explanation about what that stuff is all about. Since my bluetooth & Airport are off, I guess what Lisa mentioned about the modem talking to other devices that are on, it must be the neighbors' wifi & bluetooth stuff. Actually, I can turn off the computer & the modem is still happily chatting away with its friends.

Next I opened Activity Monitor & watched the packets. The packet count dropped and the graphic line was less active, but it never quit sending & receiving packets. It did flat line for a couple of minutes, way at the top of the chart. Then it did the graphing thing, then flat again, still at the top. (I watched for about 10 minutes, while skillfully avoiding other work.) The packet count total does increase, but much more slowly than when everything is turned back on.

Are those the packets that you mentioned, Jake, that the application Activity Monitor is sending out?
And, to confirm, turning off Airport is what turns off WiFi on the computer? (Or do I still have that one goofed up?)

Thanks for your extreme patience with my thick skull on this concept. None of this is critical for life to continue, I just like to learn.
Enjoy This Day!
Paul

 

[lclev]

Your Modem from your cable provider will ALWAYS be talking to the cable providers devices. They send it signals that check to see if it is "wake" and provide it with all the skinny as to what it need to know to work correctly. Also even if your wireless is off on your mac, there can be programs on your mac that will check to make sure it is off - Mail, if it is open, is one.

Just for fun - download the free app - Wireshark. Install it on your mac, turn on your mac's wireless and watch the activity! You will be amazed. Then turn off the wireless and see what Wireshark shows.

https://www.wireshark.org/download.html

This program is a packet analysing program that is a bit complicated because it tells you a lot. There are tons of help files online to help you dig into the nitty gritty of all it can do but for just "seeing" what is going on it is fun to see all the traffic on your network.

Once you install it the opening interface can be very confusing. Just look for the line that says - WiFi: en0 - click on those words and another screen will pop up and all kinds of information will start flooding by. I use this program for network monitoring. All those packets you see on network monitoring will be seen in full now. You can click on a line as it scrolls by and at the bottom of the window get details that probably won't mean a whole lot to you but it can be fun. Remember - you said you like to learn!

Lisa

 

[PGB1]

Thanks Lisa!
Wireshark is amazing. It is quite interesting to see how much data flows back and forth when there are no applications open. It's amazing to ponder how all of that data can be put into packets, 'shoved' down the wire and reassembled at the other end- All while not getting lost among every other computer's data flowing at the same time.

You were correct that the most of the details didn't mean a lot to me, but they got me interested to study & learn more. Networking and all things related to it have always been a mystery to me. I think I'll be spending a lot of time with Wireshark.

Thanks Again for the link and all the help that You, Jake & Pm-r supplied. I learned quite a bit and got interested to learn more.

Enjoy This Day!
Paul

 

[lclev]

Networking and how it works is quite amazing. Wireshark makes you aware of just how much "talking" is going on between all the devices on your network. I use it to observe activity. If I see something that is showing an abnormal amount of traffic and I do not recognize the external ip address, I will research it to see who owns that ip address. Sometimes it is just a computer updating - no big deal. I have also been able to track down an infected machine and fix the problem.

Unfortunately, it is impossible to get co-workers to understand that the harmless looking email/webpage is not harmless. The malware/virus will usually have to "phone home" to the mother ship and that is what I look for if I suspect an issue. Wireshark will show me which computer is providing the information to the mothership.

Lisa

 

[Csmac]

Once you install it the opening interface can be very confusing. Just look for the line that says - WiFi: en0 - click on those words and another screen will pop up and all kinds of information will start flooding by. I use this program for network monitoring. All those packets you see on network monitoring will be seen in full now. You can click on a line as it scrolls by and at the bottom of the window get details that probably won't mean a whole lot to you but it can be fun. Remember - you said you like to learn!

Lisa

Just to clarify, Lisa did you mean to say WiFi en0? On my MBP WiFi is en1 and the wired ethernet is en0.

Cliff

 

[lclev]

On the opening screen you will see a list of interfaces. If you wait a few seconds you will see a line of activity start to move across to indicate which interface is active. Mine just happens to be called en0. Yours could have a different name depending on how you are set up.




Lisa

 

[Csmac]

Thanks for the clarification, Lisa. I was obviously incorrect in my understanding that they were always assigned the same way since all my Macs so far have all been the same, but they also have all been 2012 or earlier models.

Cliff

 

[pm-r]

If it helps… using the System Preferences Network Pref Pane… normally…

"Step Three
You will be shown data on all your interfaces.

On systems with both an ethernet and wireless connection, en0 will be your ethernet interface and en1 will be your wireless interface. A MAC address will be shown for both en0 and en1 and likely labelled as "ether".

On systems with just a wireless connection, en0 will be your wireless interface. The MAC address for en0 will likely be labelled as "ether". …"

http://www.iclarified.com/30929/how-to-find-your-mac-address-in-mac-os-x




- Patrick,
======

 

[Csmac]

Thanks. That explains it.

Cliff

 

[PGB1]

Yep, Lisa, that program is quite interesting to explore. I am actually learning quite a bit.
That is a good explanation Patrick about the en assignments. I never could figure that one out.
Paul