Start-up connections via smbclient to port 139 (netbios-ssn)

Jonathan's Avatar

Jonathan

14 Feb, 2013 03:41 PM

I am running Little Snitch, which detects multiple start-up connections from pathfinder to multiple IP addresses in my local network neighborhood. I don't have active network drives. Why so many connections?

  1. 1 Posted by John on 14 Feb, 2013 04:02 PM

    John's Avatar

    Hi, I believe it is PF looking for shared network drives. Personally I noticed this also happening with Finder. Is the frequency of PF's connection attempts seemingly more numerous than that of Finder?

    On computers in which I never use Samba connected drives, I just block port 139 (and there might be one other?) from both PF and Finder. Of course I have to remember I did this on those random occasions that I might need them.

    Also, if this truly is an excessive connection attempt issue, I'd love to see a fix.

  2. 2 Posted by Jonathan on 14 Feb, 2013 04:28 PM

    Jonathan's Avatar

    I agree with your suspicion that Path Finder is looking for shared network drives. I don't have any such active connections on my work network but Pathfinder is looking anyway. Not sure how dangerous this is.

  3. Support Staff 3 Posted by Dragan on 14 Apr, 2013 11:31 PM

    Dragan's Avatar

    Hi Jonathan and John,

    I'm terribly sorry for such a delayed response, only now I see your question (and I'm constantly busy, so forgive me for that :-))

    There's nothing really fishy going on there. As you may know, finding SMB shares can be a bit problematic in Lion (and later versions of the OS X) since Apple has removed all SMB tools from the system and started using its own SMBX, which is not available to 3rd party applications developers. Therefore we bundle SMB tools with Path Finder starting from version 6, but we tried to do some more "tricks" to streamline the process of connecting to SMB shares

    One of those tricks is that once Path Finder finds a particular SMB share, it remembers its IP address in the preferences file. Next time you launch Path Finder, before trying to find the same server it first tries to connect to it using the remembered IP address. So what probably happened here is that you've been connected to some network (perhaps wirelessly) and Path Finder has found some Window machines and their shared folders (as SMB shares) with the addresses Little Snitch reports. Upon finding and connecting to them, Path Finder remembered them in the preferences file. You couldn't see any activity reported by Little Snitch at that time, because everything happened within the local network.

    Once you removed your system from that network, Path Finder still tries to connect to those IP addresses on launch, but since they're not local, it tries to establish them outside your local network so you see Little Snitch reporting them. If Little Snitch isn't installed, everything is hidden from the user, the connection won't be established (because the same shares wouldn't be find). But the things can get annoying with Little Snitch (or an app with similar functionality installed).

    You've got two options here:

    1. Just allow Path Finder (actually the bundled smbclient tool) to connect to those addresses for good, nothing bad will happen.

    2. Open Terminal.app and type this:

    defaults delete com.cocoatech.PathFinder NTSMBMasterBrowsersPrefKey

    and press ENTER

    Let me know whether this solved your problem.

  4. Dragan closed this discussion on 14 Apr, 2013 11:31 PM.

  5. Jonathan re-opened this discussion on 15 Apr, 2013 03:10 AM

  6. 4 Posted by Jonathan on 15 Apr, 2013 03:10 AM

    Jonathan's Avatar

    Many thanks. you went way beyond the call of duty.

    On Apr 14, 2013, at 5:32 PM, "Dragan" <[email blocked]> wrote:

    From: Dragan (Cocoatech Support)
    Subject: Start-up connections via smbclient to port 139 (netbios-ssn)

    Hi Jonathan and John,

    I'm terribly sorry for such a delayed response, only now I see your question (and I'm constantly busy, so forgive me for that :-))

    There's nothing really fishy going on there. As you may know, finding SMB shares can be a bit problematic in Lion (and later versions of the OS X) since Apple has removed all SMB tools from the system and started using its own SMBX, which is not available to 3rd party applications developers. Therefore we bundle SMB tools with Path Finder starting from version 6, but we tried to do some more "tricks" to streamline the process of connecting to SMB shares

    One of those tricks is that once Path Finder finds a particular SMB share, it remembers its IP address in the preferences file. Next time you launch Path Finder, before trying to find the same server it first tries to connect to it using the remembered IP address. So what probably happened here is that you've been connected to some network (perhaps wirelessly) and Path Finder has found some Window machines and their shared folders (as SMB shares) with the addresses Little Snitch reports. Upon finding and connecting to them, Path Finder remembered them in the preferences file. You couldn't see any activity reported by Little Snitch at that time, because everything happened within the local network.

    Once you removed your system from that network, Path Finder still tries to connect to those IP addresses on launch, but since they're not local, it tries to establish them outside your local network so you see Little Snitch reporting them. If Little Snitch isn't installed, everything is hidden from the user, the connection won't be established (because the same shares wouldn't be find). But the things can get annoying with Little Snitch (or an app with similar functionality installed).

    You've got two options here:

    1. Just allow Path Finder (actually the bundled smbclient tool) to connect to those addresses for good, nothing bad will happen.

    2. Open Terminal.app and type this:

    **defaults delete com.cocoatech.PathFinder NTSMBMasterBrowsersPrefKey**

    and press ENTER

    Let me know whether this solved your problem.

    View this discussion at our support site online: http://support.cocoatech.com/discussions/problems/11422-start-up-connections-via-smbclient-to-port-139-netbios-ssn
    To unsubscribe and stop receiving emails from http://support.cocoatech.com, visit
    http://support.cocoatech.com/unsubscribe/c440479c0f09abca5a87ac8171c1136c8dd2e5ba

  7. Damazio closed this discussion on 16 Apr, 2013 01:25 PM.

Comments are currently closed for this discussion. You can start a new one.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac