Little Snitch sends outgoing requests with Airport off

Question

Noob, just downloaded Little Snitch on MBP, getting familiar with background processes and shell scripts. Let x = variables.
LS is showing my mDNSResponder sending out a 225.etc request after I turn Airport off. No other machines on network are runing.
When I DLed Little Snitch and began running it, neither configd nor SystemUIServer were on the LS register. After restart, both showed up and have been sitting contentedly.
When Airport is on, Finder via nmblookup is sending a request to [x].255 about every minute that I have Safari open. When I turn Airport off, then back on, and I'm running LS, Safari to verisign connection shows up and configd connection shows up at ff[x:xx].
My concerns: Former employer is after my intellectual property. I had MBP connected on a daily basis to WiFi and certain sharing elements on with firewall off (stupid, I know, but I didn't know nad hadn't thought about it, and co. in question was pretty technologically dinosauric). Connected to same network by ethernet occasionally, and installed by disk a Windows partition and Open Office by disk given by employers' IT staff.
What's the possibility that a keystroke logger was put on my machine by an Admin of network I connected to, and is there any way to detect and disable said keylogger? Also, is there any way--outside of reverse-lookup, SPAM blacklisting sites--to check destinations of remote connections my comp might be making to an external server?

Answer 1

FWIW, mDNSResponder is the process responsible for [Bonjour|http://developer.apple.com/networking/bonjour/faq.html], Apple's name for its implementation of the popular zero-configuration networking technology. (That's what allows your Mac to discover & use network printers, local servers, etc.) And as mentioned [here|http://support.apple.com/kb/HT3789], it is also used in Snow Leopard for unicast DNS resolution; without it, that OS cannot resolve hostnames like www.apple.com.
Likewise, [nmblookup|http://developer.apple.com/library/mac/#documentation/Darwin/Referen ce/ManPages/man1/nmblookup.1.html] is the process that supports the OS X implementation of [Samba|http://en.wikipedia.org/wiki/Samba_(software)], which allows file & printer sharing between Windows & UNIX type OS's.
[configd|http://developer.apple.com/library/mac/#DOCUMENTATION/Darwin/Reference/ ManPages/man8/configd.8.html] is an essential process that among many other things supplies the dynamic network port configurations that support the above & many other network processes.
So it is perfectly normal for these processes to periodically generate outbound network activity & by itself that does not mean a key logger is installed in your system.