natd cpu usage is insane--do i have a virus???
 

alright i'm getting really annoyed with my computer lately: it seems that basically if i run any kind of network service for any given amount of time on my 15" pb g4 1.67 ghz with airport express and os x 10.4.9 then eventually, within either a day or three-four days, a process called "NATD" suddenly starts gobbling up 60-90% of cpu usage, rendering my whole system unstable of course, and eventually crashing all network processes including appleshare (i'm running a g3 as well).. seems possible culprits can be any kind of bittorrent client or anything like soulseek that constantly requires internet connections. fair enough i would be satisfied with knowing that there are bugs in these programs but i've had this computer for almost 2 years now and this problem has just started popping up within the last 2 months.

is this some virus? a sudden system bug? anyone else experiencing this? it's driving me crazy to wake up every morning to find my computer hot enough to fry an egg with the fan buzzing like a swarm of bees and having to do a cold reboot.

any ideas?

No, it's not a virus.

A process called natd indicates that you are using 'Internet Sharing'. Why don't you turn that off? System Preferences > Sharing > Internet tab > click "Stop".

Trevor

well i figured as much.. but i need to use internet sharing. why would natd eat up all cpu usage like that? anyway, i hav a 15" pb 1.67 ghz os x 10.4.9, with natd using up to 90% of cpu power then crashing all network services... can anyone help me find out why?

sorry--i need to use internet sharing. is it possible to fix some other way?

What is your network setup? In most cases, using a router is the better, safer, more efficient solution than 'Internet Sharing'.

Trevor

Most peer to peer file sharing services allow you to limit both the number of simultaneous connections and the bandwidth a given connection can use. I suggest you limit yours to one or two connections. If you have two or more going simultaneously, that requires much more processing power than one, not to mention the greater work required of the hard drive.

You may have noticed this starting to be a problem recently if/when you added files to your shared folder that are popular downloads.

my setup is simply a cable modem connected to airport, and a g3 running off ethernet thru the g4 via internet sharing. like i said before, only in the last 2 months has this caused a problem (i.e. since the most recent os x updates).. and my p2p programs (azureus is actually the only one running) are set with only 2 connections each so as to minimize any cpu drain..

i turned off internet sharing last night as well, and this morning the light on the airport base station was once again flashing yellow. arrgh!! any further suggestions?

sorry to bump this again but i am really not happy with my airport.. ever since updates 10.4.8 and 10.4.9 i've had nothing but problems.. slow speeds, conking out, having to reset to regain high speeds only to have them lost within 10 minutes of normal internet use (no i'm not using internet sharing OR p2p programs at all in an effort to determine wtf is wrong)..

it's all making me very angry that things are totally screwing up left and right on this bloody machine.. does anyone know what is wrong????

1. How much net access is the G3 using?
2. Have you consider making the G3 wireless?

okay sorry this problem seems to have shifted from "natd" to a general airport problem... i've turned off internet sharing and i'm basically letting this g4 go to waste by doing nothing with it since the internet on it is unbearably slow. nothing works. restarting airport does nothing. internet pages load at 1.1k/sec.. if they load at all. no other programs running. all since 10.4.8/9 updates.. W T F?

Did you say earlier that turning off internet sharing solved the problem? Is not, then we have to look elsewhere.

All web pages show the same problem?
Or is it different depending on what site you go to?

Try supplying the URL using the IP address of the site instead of the host name to see if that makes a difference (this would indicate a DNS problem)

Try connecting your Mac via Ethernet to the Airport base station's "LAN" jack to see if that makes a difference.

Is it possible that somebody's riding along on your network? As Hayne suggests, try putting it on ethernet, but turn off all wireless networking too. If it suddenly is fast, then you know it's something to do with Airport. I'd redo all wireless security settings at that point.

I believe that the OP mentions that it is an Airport Express Base Station. AFAIK, the Airport Express Base Station doesn't have a LAN jack.

Trevor

vollrath,

However, I'd strongly agree with Hayne that the right solution is to connect your G3 using ethernet to a router. It's just that, since your router is an Airport Express, you can't do it with that router. The right solution is to buy a router that does have an ethernet output (or four) and connect that to your G3.* Internet Sharing is a huge drain on your other computer, and only a bad kludge at best, not something that should be part of a permanent network setup.

Trevor


* In other words, Internet <--> Cable modem <--> router <--> all of your computers.

If it is an Express, maybe you could try connecting directly to your cable/dsl modem to see if that works better.

trevor, and everyone else, thanks so much for all the help.

well, it seems that although i had turned off internet sharing, the results were not immediate. after a day or so of being "left alone" the internet and airport are up and running stably. i guess i'll have to buy a router, but i'm still confused as to why internet sharing is even an option if it's merely a "bad kludge" at best? why not just disable it altogether? is the same true of firewire or usb internet sharing?

so on to the next question: what's the best hub to get? or, if i put an aiport card in the g3, would i experience any similar problems to internet sharing?

thanks,
vol

It's perhaps analogous to having a car with a large cargo area. It's useful for the occasional times when you need to transport a bunch of stuff. But if you are hauling stuff across country 5 days a week, you want a truck.

For occasional usage, Internet sharing is a useful feature.
But for day-to-day Internet connection, you want to get a dedicated router box. It might be different if the routers weren't so cheap.

hmm.. apparently an original airport card is pretty hard to get a hold of..

okay considering my g4 has airport extreme and my g3 has no wireless (not to mention i also have a non-wireless PC and an Xbox) making that a total of 4 machines, what is my best option?

I've been having the same problem recently, and I'm not using Internet Connection Sharing, so I don't think that's the cause.

I'm running 10.4.9 on an early Macbook, connected via 802.11g to a new Airport Extreme basestation.

I've been leaving the Macbook and Azureus 2.5.0.4 running for days. Suddenly the cpu goes to 90% and the fans start full blast. If I kill natd using Activity Monitor I lose network connectivity until I turn Airport off and on again.

The only reason I can think of natd even being required is if Azureus somehow makes use of it. The Airport base station is set to forward Azureus traffic to the IP of my laptop, and Azureus is happy with the NAT setup (it says 'NAT OK' in the information bar at the bottom).

Not a big deal, but it's annoying that it's just started. I think it's the 10.4.9 update that has caused it.

natd vs G4 and wireless crowding
 

2 issues: Wireless does not share well among disparate networks. If you are in an area where there may be other wireless signals (apartments, dorms, etc.) then your airport may be getting crowded out by other wireless signals, including mocrowave ovens, 2.4GHz cordless phones, some flourescent lights, and many baby monitors.

Grab iStumbler to get an idea of what signals are prevalent in your area. If you are trying to troubleshoot network configuration on a flaky wireless connection you will go insane.

Second point. natd is not flaky, and is to be revered for what it does. There are many things that can go wrong because it is inherently cheating the system. Also, for safety, it runs in userspace, while the rest of the network runs in kernel space. And bitTorrent is totally cruel to nat devices. I switched from using a linksys router to natd on my mac because bitTorrent was killing the linksys router.

(TECHNICAL STUFF:) natd being in userspace means that all data going through it must get COPIED from kernel space to userspace, get mangled by natd, and COPIED again from userspace to kernel space. Leaving and coming back. The reasons are technical, and the problem is that this copy utilizes memory bus, something that happens to be in really short supply on the last model G4s. The CPU is fast, 1.5GHz or so, but memory is slow, 133-166 MHz. And it's 32 bit. The G5 introduced 64 bit 1GHz memory busses, and have gotten faster. The Intels are using ~800MHz 64 bit. natd is cruel to the G4 memory bus.

It shouldn't run away, it should be fine. Mine runs for weeks or months with no problem, but does eat CPU under network load. But if you really want NAT that runs fast on that architecture, then Sustainable Softworks has a kernel based NAT and really nice, trustworthy software. If you are interested in learning about networks, this is a good step. It's $100 shareware last time I checked. Worth every penny for learning, understanding, troubleshooting, and controlling IP.

That nat problem is harder, and is less likely the problem. Eliminate the wireless portion of your network before you assume that the problem is anywhere else.

-ED.