Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Little Snitch, and it's telling me natd is accessing (a torrent tracker) every second or so. I have been unable to backtrace which program is making the call, and if I "block" access to for natd or all programs via Little Snitch preferences, nothing happens and the connections continue.

I've searched all my plist files in /etc/ and /SystemConfiguration/ but I haven't found at all. I also can't get an IP Address from, but I got one from, which was I also couldn't find this in any plist.

What should I do? How can I stop these connections and/or trace the program that is making the requests?


No, I'm not using / have never used Internet Sharing.

After repeatedly blocking with little snitch and natd, it has stopped happening. In fact all traffic from natd is now not appearing in Little Snitch, which is bothersome.

I checked for Mac Defender and Mac Guard (trojans disguised as anti-virus programs), but I don't have either installed. The only one I have is Norton and MacScan, which are legit.

share|improve this question

Are you using Internet Sharing? If so, it's likely a program on some other computer that's using your shared internet connection, and just being translated by natd.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.