6
$\begingroup$

My firewall (the "Application Firewall" in OS X 10.8.2) detects that Mathematica (9.0.1.0) and "MathKernel" both request incoming connections. My configuration expects all incoming connections to be blocked, so I wonder what the consequences of denying these connections is.

enter image description here

Why do Mathematica and "MathKernel" request incoming connections? What are these connections used for and what, specifically, will be the consequences of denying them?

When I allow connections, and take a quick look at them, I see that both have opened several incoming/outgoing paris of connections to "localhost", which suggests that the connections are being used for local communication between each other, as suggested in Szabolcs's answer

enter image description here enter image description here

but closer examination shows an additional connection for each that I'm not sure how to interpret

enter image description here

Blocking incoming connections seems to have no effect, and I wonder of that's really true (e.g., am I paying a performance price). Allowing would seem to be innocent, of all the connections are local; but I know of no way to guarantee that.

Improve this question
$\endgroup$
5
  • $\begingroup$ Note that this is not a question about how to achieve blocking (that works since the recent update) or about repeated requests after permission is granted. It's specifically about what, precisely, the requested connections are for. $\endgroup$
    – orome
    Commented Feb 11, 2013 at 17:30
  • 2
    $\begingroup$ One thing you can do is use something like PrivateEye. This tells you whenever applications access the network. Mathematica wants to check for and download the latest documentation and data updates, get the latest news (for the Welcome screen) - pacletserver2.wolfram.com, get results for your mis-spelt search terms (search.wolfram.com), perhaps check your license configuration, and possibly even look at your coding style and the color of your underwear. $\endgroup$
    – cormullion
    Commented Feb 11, 2013 at 17:45
  • $\begingroup$ Yes, I can see the traffic. The question is really, precisely, what are Mathematica and MathKernel using the connections for, and what the consequences of blocking them will be. $\endgroup$
    – orome
    Commented Feb 11, 2013 at 17:49
  • 1
    $\begingroup$ As far as I can see, this is due to the fact, that the front end and the kernel are, by default, preparing to accept a remote connection from another kernel/front end. $\endgroup$
    – Stefan
    Commented Feb 11, 2013 at 18:14
  • 2
    $\begingroup$ plus...the front-end interface and the kernel are communicating through MathLink protocol which, on Mac, is using TCP/IP, TCP, SharedMemory, or Pipes.These connections are needed to exchange data between those two independent processes. $\endgroup$
    – Stefan
    Commented Feb 11, 2013 at 18:23

1 Answer 1

Reset to default
5
$\begingroup$

This is most likely due to MathLink. The MathLink protocol can transfer information in several ways, most commonly using shared memory (the default on the local machine) and TCP/IP (when different computers communicate). Even if you just launch an installable MathLink program separately (not using Install), first it will prompt you for the name of a new link to create. Then you will get a firewall warning (if you have your firewall configured to prompt you in these situations) because it is waiting for incoming connections on this link.

Programs that use MathLink can either attempt to actively connect to a link or they can wait for incoming connections (see LinkCreate's LinkMode option).

I don't believe blocking these connections will break things that run only on your local machine because they should use shared memory links, but they most likely will break remote kernels.

Improve this answer
$\endgroup$
5
  • $\begingroup$ A lot of this stuff is not well documented, or is only mentioned in some of the longer read tutorials. I don't remember where I read some of these things and I may be wrong about the details. $\endgroup$
    – Szabolcs
    Commented Feb 11, 2013 at 19:14
  • $\begingroup$ So Mathematica and MathLink will open these connections even if I've done nothing at all (e.g., am opening a blank instance of Mathematica) so that they can communicate using TCP/IP when the need arises? $\endgroup$
    – orome
    Commented Feb 11, 2013 at 20:51
  • $\begingroup$ @raxacoricofallapatorius I believe what happens is that the front end creates a link, then launches the kernel and waits for it to connect back. This is typically a shared memory link, so I am not sure why it would listen on TCP/IP. There's also a number of other links, for connecting to Java (lots of things use J/Link), and for parallel kernels. $\endgroup$
    – Szabolcs
    Commented Feb 11, 2013 at 20:54
  • $\begingroup$ That's consistent with what I see (see edit), but I wonder about an additional connection; whether there's some hidden cost to blocking; and, how to ensure that the incoming connections remain local. $\endgroup$
    – orome
    Commented Feb 11, 2013 at 22:48
  • $\begingroup$ I can at last confirm (after a week of back and forth with Wolfram's incompetent "support", including wrong answers that I had to correct!) that this is the right answer. Thank goodness for Mathematica.SE! $\endgroup$
    – orome
    Commented Feb 21, 2013 at 4:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.