sudo lsof -i no longer returns most processes after updating to Sequoia

[svenmany]

I don't understand as, sudo lsof -l|grep EST,
works here.

What do you mean that it works?

 

[buggz]

It shows the ESTABLISHED connections.

 

[JoeSilver]

I don't understand as, sudo lsof -l|grep EST,
works here.

But it doesn't show all the active connections. Again, for Safari, it only shows an open file named "RESTRICTED_OPENER_DOMAINS.wplist" somewhere in /private/var

It show all the ESTABLISHED connections of Mail, yes, but by all means not all the network activity which is going on.
At least not as I am used on Linux, for example.

However if i try

sudo tcpdump -i en7 udp

for example, where en7 is my LAN interface, I see a lot of "quic" connections, although it's still difficult to find the ones linked to Safari navigation.

Another more sophisticate network "sniffer" I recommend is Wireshark

 

[svenmany]

It shows the ESTABLISHED connections.

The OP is only interested in internet connections. I had misread the command you typed. I see now that what I thought was an "i", you typed "l". So, you're going to get a lot of stuff that has nothing to do with internet connections. When I use your command, I get irrelevant lines with the word MANIFEST in them. "lsof", which stands for "list open files", will list all kinds of files, not just sockets. Maybe you just mistyped.

With respect to internet sockets, ESTABLISHED only applies to TCP; it's one of a number states a TCP socket can be in.

TCP State Transition Diagram

Have you ever seen ESTABLISHED on a UDP socket?

Certainly the OP, who is missing a lot of stuff when using "lsof -i", will miss much more when filtering for TCP established connections.

Another more sophisticate network "sniffer" I recommend is Wireshark

Thanks for that. I hadn't thought to use it for the investigation. Using it I've found proof that Safari sockets are not included in the output of lsof. I opened the monitoring dashboard on my local OPNsense router. The command I used was "lsof -i@<ip of router>. Wireshark showed the TCP traffic and lsof showed nothing. I repeated the experiment with Firefox and lsof showed the open socket. This test eliminates any confusion of process naming or whether the traffic is TCP or UDP.

So - issue confirmed. This is significant.

 

[splifingate]

But I have no idea what is actually causing it or how to fix it.

Are you logged-in with a Regular User Account?

I do, and I cannot perform Administrator actions until I allow my $ADMINNAME to occupy the Terminal:

% su - $ADMINNAME
Password: --> Authenticate

Then perform:

% sudo lsof -l|grep EST
Password: --> Authenticate

Why?

Ever-intensifying efforts to secure the System?

Confuse seasoned Veterans?

Force us to buy iPads?

 

[JoeSilver]

I am a bit confused. I don't have a separate admin account, the environment variable ADMINNAME is not set and, even if it was possible, I can't see why we would need to login as admin and still have to run the command with sudo.

 

[humpbacktwale]

But without further investigation, my only reason I think something is hidden is that you see a difference from the previous OS. I trust your memory.

One thing I do notice is that a a number of the Apple processes, which communicate to their servers via https, are using the UDP-based QUIC protocol. Maybe that's new and the reason you no longer see established connections to Apple servers that you used to see. But, that's just a guess.

Hmmm now there's an idea. Maybe that explains it. Still very strange though. The same processes are running and appearing under network activty. But besides what you are suggesting, I cannot think of a single reason why they'd all suddenly no longer make remote connections.

 

[svenmany]

Hmmm now there's an idea. Maybe that explains it. Still very strange though. The same processes are running and appearing under network activty. But besides what you are suggesting, I cannot think of a single reason why they'd all suddenly no longer make remote connections.

You did read my post that I've confirmed processes are hidden in lsof output? It was at the end of my post #29.

 

[svenmany]

There's no way Apple support will assist with this. Maybe raise the issue on the lsof Github repository.

Issues · lsof-org/lsof

LiSt Open Files. Contribute to lsof-org/lsof development by creating an account on GitHub.

github.com

The following site suggests that the Darwin version is actively maintained there with all others. Hopefully Apple is not screwing around with it.

https://lsof.readthedocs.io/en/latest/