Step 3: lsof: Unix's Secret Weapon
Launch the Terminal (/Applications/Utilities), type lsof, and press Return to see a list of every open file on your Mac-ours returned a list of over 1,000 files. To limit lsof's range, type the following: lsof +D /Users/user name/Music/iTunes/iTunes\ Music -i. The +D option limits lsof to files inside the specified directory, including all of its subdirectories, while -i limits the search to files opened over your network. The results show any open files in your Music folder as well as the connected user's machine name, which is often the user's name or some truncation of it, but savvy users can change their Mac's reported name via System Preferences' Sharing pane - notice in the screenshot that we renamed our Mac Dumbo.
Who knew Rik and Roman were such metalheads?
Step 4: Browse Bonjour
We changed our Mac's name to Dumbo, but our iTunes share is called Guilty Pleasures. Here's how to connect the dots to see who's hiding behind an innocuous share title such as, say, Guilty Pleasures. First, type lsof +D /Users/user name/Music/iTunes/iTunes\ Music -i -n in the Terminal, and press Return. The -n option tells lsof not to convert network numbers to host names, so now Dumbo appears as 10.15.5.83. Fire up Bonjour Browser (free, www.tildesoft.com/Programs.html) for a report on all Bonjour traffic on the local subnet. Scroll down Bonjour Browser's list to iTunes Music Sharing (_daap._tcp.), click the disclosure triangle to see all the local iTunes sharers, and click on any share's triangle to reveal the source's IP address. In our screenshot, Guilty Pleasures is coming from 10.15.5.83-the same number lsof returned in place of Dumbo. This won't tell you what songs Mr. 10.15.5.83 (aka Guilty Pleasures, aka Dumbo) is listening to, but it will show you which iTunes share is his.
