Transmission allows 'rogue' Mac OS X Kernel connections

[ethien]

Hi there

I have been using Transmission for a long while and the odd bug aside, I've never had any complaints about it.

However I recently upgraded Little Snitch 1 to version 2, which includes a network monitor. I have noticed that when and only when Transmission is running, the Mac OS X Kernel connects to a lot of IPs, here's a connection log from LS after 5 minutes of Transmission running:

Connection report for process: Mac OS X Kernel (/mach_kernel)
Total: 0 Bytes sent, 475 Bytes received
i-195-137-6-244.freedom2surf.net (195.137.6.244), Port 53887 (unnamed), Protocol 6 (TCP), 0 Bytes sent, 235 Bytes received
c83-254-135-197.bredband.comhem.se (83.254.135.197), Port 63267 (unnamed), Protocol 6 (TCP), 0 Bytes sent, 68 Bytes received
c-68-42-52-130.hsd1.fl.comcast.net (68.42.52.130), Port 60110 (unnamed), Protocol 6 (TCP), 0 Bytes sent, 104 Bytes received
adsl-69-154-212-78.dsl.ksc2mo.swbell.net (69.154.212.78), Port 3867 (unnamed), Protocol 6 (TCP), 0 Bytes sent, 68 Bytes received

Of course I have tried to apply a rule in LS to deny the kernel any connection, but to no effect whatsoever. ObDev (devs of LS) don't seem to think it's anything to do with them, that it's Transmission that allows the kernel to bypass LS.

Any other users out there with similar experience?

Could we possibly have the Transmission dev(s) opinion on that front? Is that normal behaviour?

Thanks a lot

[SamuV]

I've noticed this too, and I wish someone would supply a straight answer. I don't like to use software that's doing things behind my back. If there's a legit reason for the kernel activity, I'd like to know to end my paranoi, but I just get more paranoid from a lack of answers.

[SamuV]

It's because of port forwarding in your router and/or the software! Try it. Change the port, kernel stops activity!

[nilloc]

Port forwarding doesn't appear to affect it, I've got successful port forwarding working (shows the little green light in prefs) and still have the random hosts coming through the kernel.

Unchecking "Automatically map port" almost stops them, though i still got a kernel connection when first loading a new torrent file.

Still a bit frustrating though.

[hardhat]

Running: Transmission 1.76 (9392) / LS 2.1.4

I have always been running Transmission with my Peer listening port blocked showing the red circle next to it ( for at least 2 years ).... so in my quest to unblock it ( to get some potential download speed ) I followed the help features within Transmission. As soon as I went to my firewall settings in my "System Preferences" and selected Transmission to "allow incoming connections" my "Peer listening Port" in Transmission turned green. As soon as I did that Little Snitch's network monitor showed "Mac OS X Kernel" connecting to tons of ip addresses. ( and looking like it was mirroring my transmission activity )

The second I went back to my firewall settings in my system preferences and selected Transmission to "block incoming connections" all Mac OS X Kernel activity stopped completely.

I know that this doesn't shed any light on what is exactly going on under the hood... but at least this is something consistent. If anyone has any more information to clarify what is happening... why its happening... and if its normal or not..... post away...

[Rick1]

Check out these threads at LittleSnitch forum.
http://forums.obdev.at/viewtopic.php?f=1&t=3679
http://tinyurl.com/ydqugg4
http://tinyurl.com/ycavpxr
http://tinyurl.com/y9zr469
SamuV gave the same answer in every thread there, as given here, but it does not seem to match answer given by johannes (LS Objective Development) on 11/14/7 in the last url.
The problem with johannes answer is the problem was not corrected in next service release of Little Snitch.
Not a solution, but does show it is not a problem caused by Transmission.

Rick