Just got new iMac and installed Norton Internet Security for Mac. I’m new to both Mac and Norton. In my firewall statistics (current network connections) I notice up to 20 connections (out of my computer) that Safari is making. They’re all “web sharing” on port 80. “Web Sharing” and “file sharing” are turned off in my iMac preferences. My wireless router is locked. Are these connections simply to components of web pages accessed, or are they caused by RSS, or are they unauthorized connections that might allow others to share my computer? Thanks
Outbound connections on port 80 are almost always from you browsing the Web. The can sometimes remain open even if you close the window because Safari will try to use "keep-alive" connections when possible.
Safari also has several features that cause it to download Web content in the background. The "Top Sites" feature, and the "RSS" reader will do this, causing outbound connections on port 80 even when you're not browsing the Web. Connection Tracking will list the IP address and domain name of the Web sites being accessed, which you can use to determine the type of activity that is occurring. For example, if the domain name is something like "feeds.nytimes.com" then it's probably RSS. But as long as the application name is "Safari", its probably benign activity.
This is what makes the Connection Tracking feature of Norton Firewall interesting :-)
Austin,
Check the IP addresses in question using a service like:
This will let you idenitfy who owns the IP address block. Some of them I suspect most likely belong to your ISP, in which case it's just how your ISP is handling there port-80 web traffic. When you open applications like iPhoto, and iTunes, for example, they don't just access Apple. They access, Apple, Apple's affiliates (like Omniture, Inc.), Rackspace where servers are hosted, etc,. Most people never see this traffic, because they use firewalls that allow all outbound traffic for applications. This is how company's supposedly make your web experience better, but at the same time track what you do.
Anyway, if the IP addresses belong to your ISP, then what you are seeing is your web requests hitting your ISP's internet server farm for your area/region first. Again, its the tracking thing. Otherwise, if none of them belong to your ISP, then Ryan's answer is on the mark.
Hope this helps.
Thank you to both Ryan and Tom. After reading your posts and looking at the situation again I realize this is probably normal browser traffic showing up. When visiting a new web site the connections spike and then go away.
Thanks again,
Austin