Sunday, April 10, 2016
Saw unexpected network activity
I try to keep an eye on my machine for memory, CPU and network activity on the netbook. Normally when there is nothing running it is pretty quiet. Today I installed a number of packages to help me manage the system and my photos among other packages. I noticed that there was a lot of network activity even when nothing was running and that had me concerned. I have a limit per month for usage and then I pay. Even though the usage wasn't a lot (less than a kilo every 10 seconds) it does add up. I decided to search to see what was doing the activity. I downloaded iptraf and started there to see what was doing the connections. I quickly could see port 123 and 1900 were the offenders. Port 123 is for NTP so I was not too concerned there. Port 1900 did cause me concern as every 10 seconds it would talk to someone outside my home network. Next up I ran the lsof command (using SUDO) for 123 and 1900. My suspicions that 123 was NTP was correct. Port 1900 was minidlna. I think it was for some of my multimedia software so I didn't want to kill it. I did the next best thing, I found the config file and pointed it to eth0 and not wlan0, effectively killing it as I don't have networking set up for that. Once I made the changes and did a quick reboot (yes, there is probably an easier way, but, it was the easiest for me at that time). Once I logged back in the network went back to normal.