Sunday, April 10, 2016

Saw unexpected network activity

I try to keep an eye on my machine for memory, CPU and network activity on the netbook.  Normally when there is nothing running it is pretty quiet.  Today I installed a number of packages to help me manage the system and my photos among other packages.  I noticed that there was a lot of network activity even when nothing was running and that had me concerned.  I have a limit per month for usage and then I pay.  Even though the usage wasn't a lot (less than a kilo every 10 seconds) it does add up.  I decided to search to see what was doing the activity.  I downloaded iptraf and started there to see what was doing the connections.  I quickly could see port 123 and 1900 were the offenders.  Port 123 is for NTP so I was not too concerned there.  Port 1900 did cause me concern as every 10 seconds it would talk to someone outside my home network.  Next up I ran the lsof command (using SUDO) for 123 and 1900.  My suspicions that 123 was NTP was correct.  Port 1900 was minidlna.  I think it was for some of my multimedia software so I didn't want to kill it.  I did the next best thing, I found the config file and pointed it to eth0 and not wlan0, effectively killing it as I don't have networking set up for that.  Once I made the changes and did a quick reboot (yes, there is probably an easier way, but, it was the easiest for me at that time).  Once I logged back in the network went back to normal.

No comments: