osx-lionnetstatloopbackrootkit

loopback on tcp port from localhost to localhost

I've seen running netstat that there are two strange tcp connection opened:

tcp4       0      0  localhost.49153    localhost.1023 ESTABLISHED
tcp4       0      0  localhost.1023     localhost.49153 ESTABLISHED

I wonder if it is normal. Can someone help me? thank you!

Solution

  • Yes, that's just normal loopback used by OS X. Checkout a Apples port usage publication 

     port          service      description
-------------+------------+------------------
 600-1023    | ipcserver  | Mac OS X RPC-based services
 49152-65535 | Xsans      | Xsan Filesystem Access
 49152-65535 | misc       | Back to My Mac