# Why do Mathematica and MathKernel need “incoming connections”?

My firewall (the "Application Firewall" in OS X 10.8.2) detects that Mathematica (9.0.1.0) and "MathKernel" both request incoming connections. My configuration expects all incoming connections to be blocked, so I wonder what the consequences of denying these connections is.

Why do Mathematica and "MathKernel" request incoming connections? What are these connections used for and what, specifically, will be the consequences of denying them?

When I allow connections, and take a quick look at them, I see that both have opened several incoming/outgoing paris of connections to "localhost", which suggests that the connections are being used for local communication between each other, as suggested in Szabolcs's answer

but closer examination shows an additional connection for each that I'm not sure how to interpret

Blocking incoming connections seems to have no effect, and I wonder of that's really true (e.g., am I paying a performance price). Allowing would seem to be innocent, of all the connections are local; but I know of no way to guarantee that.

-
Note that this is not a question about how to achieve blocking (that works since the recent update) or about repeated requests after permission is granted. It's specifically about what, precisely, the requested connections are for. –  raxacoricofallapatorius Feb 11 '13 at 17:30
One thing you can do is use something like PrivateEye. This tells you whenever applications access the network. Mathematica wants to check for and download the latest documentation and data updates, get the latest news (for the Welcome screen) - pacletserver2.wolfram.com, get results for your mis-spelt search terms (search.wolfram.com), perhaps check your license configuration, and possibly even look at your coding style and the color of your underwear. –  cormullion Feb 11 '13 at 17:45
Yes, I can see the traffic. The question is really, precisely, what are Mathematica and MathKernel using the connections for, and what the consequences of blocking them will be. –  raxacoricofallapatorius Feb 11 '13 at 17:49
As far as I can see, this is due to the fact, that the front end and the kernel are, by default, preparing to accept a remote connection from another kernel/front end. –  Stefan Feb 11 '13 at 18:14
plus...the front-end interface and the kernel are communicating through MathLink protocol which, on Mac, is using TCP/IP, TCP, SharedMemory, or Pipes.These connections are needed to exchange data between those two independent processes. –  Stefan Feb 11 '13 at 18:23

This is most likely due to MathLink. The MathLink protocol can transfer information in several ways, most commonly using shared memory (the default on the local machine) and TCP/IP (when different computers communicate). Even if you just launch an installable MathLink program separately (not using Install), first it will prompt you for the name of a new link to create. Then you will get a firewall warning (if you have your firewall configured to prompt you in these situations) because it is waiting for incoming connections on this link.

Programs that use MathLink can either attempt to actively connect to a link or they can wait for incoming connections (see LinkCreate's LinkMode option).

I don't believe blocking these connections will break things that run only on your local machine because they should use shared memory links, but they most likely will break remote kernels.

-
A lot of this stuff is not well documented, or is only mentioned in some of the longer read tutorials. I don't remember where I read some of these things and I may be wrong about the details. –  Szabolcs Feb 11 '13 at 19:14
So Mathematica and MathLink will open these connections even if I've done nothing at all (e.g., am opening a blank instance of Mathematica) so that they can communicate using TCP/IP when the need arises? –  raxacoricofallapatorius Feb 11 '13 at 20:51
@raxacoricofallapatorius I believe what happens is that the front end creates a link, then launches the kernel and waits for it to connect back. This is typically a shared memory link, so I am not sure why it would listen on TCP/IP. There's also a number of other links, for connecting to Java (lots of things use J/Link), and for parallel kernels. –  Szabolcs Feb 11 '13 at 20:54
That's consistent with what I see (see edit), but I wonder about an additional connection; whether there's some hidden cost to blocking; and, how to ensure that the incoming connections remain local. –  raxacoricofallapatorius Feb 11 '13 at 22:48
I can at last confirm (after a week of back and forth with Wolfram's incompetent "support", including wrong answers that I had to correct!) that this is the right answer. Thank goodness for Mathematica.SE! –  raxacoricofallapatorius Feb 21 '13 at 4:44