Loopback open multiple interfaces?

[Prplehz76]

Excuse my ignorance but I’m trying to weed out a multimedia issue I’m having with my Mac Pro and IPhone 7+. Is it normal that loopback is open and active on 4-6 ports at any given time? Even if I turn off WiFi and I open a terminal window and use lsof -i I can see processes open and an established connection to localhost!! I use the kill command but they just immediately cycle back on! Any help or advice is appreciated? The processes are using tremendous resources and files are generating bogging down my system. I suspect Xcode must be doing something but I don’t use the program.

 

[HDFan]

I can see processes open and an established connection to localhost!! I use the kill command but they just immediately cycle back on!

What processes? What version of MacOS? Which MacPro? What resources are they using?

 

[techwarrior]

There are likely to be a number of internal resources that use localhost to resolve inter process communications.

For instance, the following are several processes on my machine (localhost) with established connections to 41416
localnode 3005 macuser 19u IPv4 0xe2bc92d35e17979d 0t0 TCP localhost:41416 (LISTEN)
localnode 3005 macuser 21u IPv4 0xe2bc92d3718ca19d 0t0 TCP localhost:52495->localhost:41416 (ESTABLISHED)
localnode 3005 macuser 22u IPv4 0xe2bc92d3718cb49d 0t0 TCP localhost:41416->localhost:52495 (ESTABLISHED)

com.apple 3238 macuser 16u IPv4 0xe2bc92d36c12819d 0t0 TCP localhost:52528->localhost:41416 (ESTABLISHED)
com.apple 3238 macuser 17u IPv4 0xe2bc92d36c12819d 0t0 TCP localhost:52528->localhost:41416 (ESTABLISHED)

Using 'ps -ef | grep 3005' and 'ps -ef | grep 3238 I see these are communications between webkit (3238) and Ubersicht (3005) which is for desktop "widgets" that are regularly refreshed on my desktop.

When you kill processes that are meant to always be running, or are sub-processes of a master process, launchd or the master will re-spawn them.

Using ps -ef, you can determine which processes are using the ports. Activity Monitor has a few analysis tools you can use to get a better idea what these are doing.

 

[Prplehz76]

There are likely to be a number of internal resources that use localhost to resolve inter process communications.

For instance, the following are several processes on my machine (localhost) with established connections to 41416
localnode 3005 macuser 19u IPv4 0xe2bc92d35e17979d 0t0 TCP localhost:41416 (LISTEN)
localnode 3005 macuser 21u IPv4 0xe2bc92d3718ca19d 0t0 TCP localhost:52495->localhost:41416 (ESTABLISHED)
localnode 3005 macuser 22u IPv4 0xe2bc92d3718cb49d 0t0 TCP localhost:41416->localhost:52495 (ESTABLISHED)

com.apple 3238 macuser 16u IPv4 0xe2bc92d36c12819d 0t0 TCP localhost:52528->localhost:41416 (ESTABLISHED)
com.apple 3238 macuser 17u IPv4 0xe2bc92d36c12819d 0t0 TCP localhost:52528->localhost:41416 (ESTABLISHED)

Using 'ps -ef | grep 3005' and 'ps -ef | grep 3238 I see these are communications between webkit (3238) and Ubersicht (3005) which is for desktop "widgets" that are regularly refreshed on my desktop.

When you kill processes that are meant to always be running, or are sub-processes of a master process, launchd or the master will re-spawn them.

Using ps -ef, you can determine which processes are using the ports. Activity Monitor has a few analysis tools you can use to get a better idea what these are doing.

Thank you for that guidance..... I’m worried about the one that has 3 IPs is connected via Ethernet (granted I don’t have any Ethernet at home) then seem to connect via “other” and then localhost.

I’ll try and forward a screenshot! If I use “Nettop” or lsof -i it’s telling me beam.smp, node, xpccouchs, Bluetooth, sharingd, airplay, wifiagent are all processes open and have established connections. Launchd is being accessed via netbios which ALL my sharing options are off and if I turn off my WiFi is still occurring? Is this a remote user or a network virus?

FYI I’m running Mac OS X High Sierra 10.3