0

Through "nettop" command using the terminal on macOS, I noticed a connection initiated by curl that pops up every 30 seconds and would disappear very quickly (under root account). I was able to grab the destination IP address but I really had no idea which file(s) were transferred. Is there a way I can find that information?

Tyler P.
  • 23
  • 4
  • 1
    Carefully read my answer here about putting a wrapper around the `shutdown` binary and then consider doing the same around `curl`. https://stackoverflow.com/a/24202568/2836621 – Mark Setchell Aug 11 '18 at 19:48

1 Answers1

0

My approach would be to copy curl binary under a different name and place my own script/binary in place of original one. The script/binary would log all passed parameters to a log file. I'm not familiar with macOS programming/scripting though.

Krystian G
  • 2,842
  • 3
  • 11
  • 25