1

Without any programs open except an empty terminal window and System Monitor, I'm seeing network traffic. Roughly every 1 second there's a small spike in outbound and a little inbound traffic. $ sudo tcpdump -vv -A shows a pretty much constant polling of random IPs. Snippets of netstat and tcpdump included below. Idling, CPU use is pretty low and nothing stands out in RAM use. How can I find the processes initiating this traffic to either ensure that they're legitimate and/or remove them?

Stackoverflow is limiting input to 30000 characters, so I've truncated or removed output of netstat/tcpdump/ps and will post a linked versions shortly.

Edit: Links: netstat tcpdump ps

I have postgres and tor running (5432/9050).


$ uname -a
Linux localhost.localdomain 5.9.11-100.fc32.x86_64 #1 SMP Tue Nov 24 19:16:53 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux


$ netstat -avnp 
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      -                   
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:9050          0.0.0.0:*               LISTEN      -                   
tcp        0      0 192.168.43.5:59018      82.165.103.72:443       ESTABLISHED -                   
tcp6       0      0 :::3306                 :::*                    LISTEN      -                   
tcp6       0      0 :::111                  :::*                    LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::5298                 :::*                    LISTEN      11406/telepathy-sal 
tcp6       0      0 ::1:631                 :::*                    LISTEN      -                   
tcp6       0      0 :::443                  :::*                    LISTEN      -                   
netstat: no support for `AF INET (sctp)' on this system.
netstat: no support for `AF INET (sctp)' on this system.
udp        0      0 0.0.0.0:52467           0.0.0.0:*                           -                   
udp        0      0 127.0.0.1:36654         127.0.0.1:36654         ESTABLISHED -                   
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           -                   
udp        0      0 192.168.122.1:53        0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:67              0.0.0.0:*                           -                   
udp        0      0 192.168.43.5:68         192.168.43.1:67         ESTABLISHED -                   
udp        0      0 0.0.0.0:111             0.0.0.0:*                           -                   
udp        0      0 127.0.0.1:323           0.0.0.0:*                           -                   
udp6       0      0 :::52486                :::*                                -                   
udp6       0      0 :::5353                 :::*                                -                   
udp6       0      0 :::111                  :::*                                -                   
udp6       0      0 ::1:323                 :::*                                -                   
raw6       0      0 :::58                   :::*                    7           -                   
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   PID/Program name     Path
unix  2      [ ACC ]     STREAM     LISTENING     67663    -                    @/tmp/dbus-pKviT04I
unix  2      [ ACC ]     STREAM     LISTENING     53227    -                    @/tmp/.ICE-unix/8573
unix  2      [ ACC ]     STREAM     LISTENING     67816    9768/gnome-session-  @/tmp/.ICE-unix/9768
unix  2      [ ]         DGRAM                    66631    9477/systemd         /run/user/1000/systemd/notify
unix  2      [ ]         DGRAM                    51406    -                    /run/user/42/systemd/notify
unix  2      [ ACC ]     STREAM     LISTENING     66634    9477/systemd         /run/user/1000/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     51409    -                    /run/user/42/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     66641    9477/systemd         /run/user/1000/bus
unix  2      [ ACC ]     STREAM     LISTENING     51418    -                    /run/user/42/bus
unix  2      [ ACC ]     STREAM     LISTENING     66642    9477/systemd         /run/user/1000/pipewire-0
unix  2      [ ACC ]     STREAM     LISTENING     51419    -                    /run/user/42/pipewire-0
unix  2      [ ACC ]     STREAM     LISTENING     66643    9477/systemd         /run/user/1000/pulse/native
unix  2      [ ACC ]     STREAM     LISTENING     51420    -                    /run/user/42/pulse/native
unix  2      [ ACC ]     STREAM     LISTENING     66644    9477/systemd         /run/user/1000/snapd-session-agent.socket
unix  2      [ ACC ]     STREAM     LISTENING     51421    -                    /run/user/42/snapd-session-agent.socket
unix  2      [ ACC ]     STREAM     LISTENING     66160    -                    /run/user/1000/keyring/control
unix  2      [ ACC ]     STREAM     LISTENING     52894    -                    @/tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     63365    9508/Xorg            @/tmp/.X11-unix/X1
unix  2      [ ACC ]     STREAM     LISTENING     46547    -                    /tmp/.s.PGSQL.5432
unix  3      [ ]         DGRAM                    1331     -                    /run/systemd/notify
unix  2      [ ACC ]     STREAM     LISTENING     40772    -                    @irqbalance7670.sock
unix  2      [ ]         DGRAM                    42543    -                    /var/run/chrony/chronyd.sock
unix  2      [ ACC ]     STREAM     LISTENING     67857    -                    /run/user/1000/keyring/pkcs11
unix  2      [ ACC ]     STREAM     LISTENING     67860    -                    /run/user/1000/keyring/ssh
unix  25     [ ]         DGRAM                    1343     -                    /run/systemd/journal/dev-log
unix  2      [ ACC ]     STREAM     LISTENING     1345     -                    /run/systemd/journal/stdout
unix  17     [ ]         DGRAM                    1347     -                    /run/systemd/journal/socket
unix  2      [ ACC ]     STREAM     LISTENING     52895    -                    /tmp/.X11-unix/X0
unix  2      [ ]         DGRAM                    42554    -                    /run/systemd/home/notify
unix  2      [ ACC ]     STREAM     LISTENING     42556    -                    /run/systemd/userdb/io.systemd.Home
unix  2      [ ACC ]     STREAM     LISTENING     53228    -                    /tmp/.ICE-unix/8573
unix  2      [ ACC ]     STREAM     LISTENING     44662    -                    @/tmp/dbus-BLXNiJvO
unix  2      [ ACC ]     STREAM     LISTENING     63366    9508/Xorg            /tmp/.X11-unix/X1
unix  2      [ ACC ]     STREAM     LISTENING     40909    -                    /var/run/mcelog-client
unix  2      [ ACC ]     STREAM     LISTENING     63471    -                    /tmp/ssh-jxgRTFKssaxH/agent.9522
unix  2      [ ACC ]     STREAM     LISTENING     67817    9768/gnome-session-  /tmp/.ICE-unix/9768
unix  2      [ ACC ]     STREAM     LISTENING     66417    9766/pulseaudio      /tmp/.esd-1000/socket
unix  2      [ ACC ]     STREAM     LISTENING     36320    -                    @ISCSID_UIP_ABSTRACT_NAMESPACE
unix  2      [ ACC ]     STREAM     LISTENING     42933    -                    /var/run/abrt/abrt.socket
unix  2      [ ]         DGRAM                    511876   -                    @userdb-0bee4a4179405db591eb1f23b10b2ef5
unix  2      [ ACC ]     STREAM     LISTENING     46190    -                    /var/lib/gssproxy/default.sock
unix  2      [ ACC ]     STREAM     LISTENING     44663    -                    @/tmp/dbus-ahGNYpqL
unix  2      [ ACC ]     STREAM     LISTENING     46191    -                    /run/gssproxy.sock
unix  2      [ ACC ]     STREAM     LISTENING     67092    9812/ibus-daemon     @/home/dave/.cache/ibus/dbus-i8FrV8PD
unix  2      [ ACC ]     STREAM     LISTENING     48210    -                    /var/lib/mysql/mysql.sock
unix  2      [ ACC ]     STREAM     LISTENING     57485    -                    @/var/lib/gdm/.cache/ibus/dbus-DKte3KoP
unix  2      [ ACC ]     STREAM     LISTENING     31759    -                    /run/systemd/private
unix  2      [ ACC ]     STREAM     LISTENING     31761    -                    /run/systemd/userdb/io.systemd.DynamicUser
unix  2      [ ACC ]     STREAM     LISTENING     46546    -                    /var/run/postgresql/.s.PGSQL.5432
unix  2      [ ACC ]     STREAM     LISTENING     67662    -                    @/tmp/dbus-IIRpKdPq
unix  2      [ ACC ]     STREAM     LISTENING     82818    11081/gpg-agent      /run/user/1000/gnupg/S.gpg-agent
unix  2      [ ACC ]     STREAM     LISTENING     82819    11081/gpg-agent      /run/user/1000/gnupg/S.gpg-agent.extra
unix  2      [ ACC ]     STREAM     LISTENING     31775    -                    /run/lvm/lvmpolld.socket
unix  2      [ ACC ]     STREAM     LISTENING     82820    11081/gpg-agent      /run/user/1000/gnupg/S.gpg-agent.browser
unix  2      [ ACC ]     STREAM     LISTENING     30928    -                    /run/rpcbind.sock
unix  2      [ ACC ]     STREAM     LISTENING     82821    11081/gpg-agent      /run/user/1000/gnupg/S.gpg-agent.ssh
unix  2      [ ACC ]     SEQPACKET  LISTENING     30938    -                    /run/systemd/coredump
unix  2      [ ACC ]     SEQPACKET  LISTENING     30939    -                    /run/udev/control
unix  2      [ ACC ]     STREAM     LISTENING     30941    -                    /run/systemd/userdb/io.systemd.Multiplexer
unix  2      [ ACC ]     STREAM     LISTENING     44660    -                    @/tmp/dbus-hAFg9qTn
unix  2      [ ACC ]     STREAM     LISTENING     46599    -                    /run/php-fpm/www.sock
unix  2      [ ACC ]     STREAM     LISTENING     46783    -                    /run/tor/control
unix  2      [ ACC ]     STREAM     LISTENING     36319    -                    @ISCSIADM_ABSTRACT_NAMESPACE
unix  2      [ ACC ]     STREAM     LISTENING     32933    -                    /run/systemd/journal/io.systemd.journal
unix  2      [ ]         DGRAM                    512559   -                    @userdb-8500a1c0a265cfbe91b58a45b58a3bde
unix  2      [ ]         DGRAM                    511808   -                    @userdb-1b21fdefb8bd190f692ad71a7eef8350
unix  2      [ ACC ]     STREAM     LISTENING     53938    -                    @/tmp/dbus-3NH5zvD2zn
unix  2      [ ACC ]     STREAM     LISTENING     36313    -                    /run/avahi-daemon/socket
unix  2      [ ACC ]     STREAM     LISTENING     44661    -                    @/tmp/dbus-j9jAEHL8
unix  2      [ ACC ]     STREAM     LISTENING     36315    -                    /run/cups/cups.sock
unix  2      [ ACC ]     STREAM     LISTENING     36317    -                    /run/dbus/system_bus_socket
unix  2      [ ACC ]     STREAM     LISTENING     36321    -                    /run/libvirt/libvirt-sock
unix  2      [ ACC ]     STREAM     LISTENING     36323    -                    /run/libvirt/libvirt-admin-sock
unix  3      [ ]         STREAM     CONNECTED     57165    -                    /run/systemd/journal/stdout
unix  3      [ ]         STREAM     CONNECTED     58014    -                    /run/systemd/journal/stdout
unix  3      [ ]         STREAM     CONNECTED     52132    -                    
unix  3      [ ]         STREAM     CONNECTED     54625    -                    
unix  2      [ ]         DGRAM                    43076    -                    
unix  3      [ ]         STREAM     CONNECTED     36583    -                    
unix  3      [ ]         STREAM     CONNECTED     95305    11524/seahorse       
unix  3      [ ]         STREAM     CONNECTED     71114    10046/gsd-usb-prote  
unix  3      [ ]         STREAM     CONNECTED     66528    9756/dbus-broker     @00747
unix  3      [ ]         STREAM     CONNECTED     67097    9520/dbus-broker     /run/user/1000/bus
unix  3      [ ]         STREAM     CONNECTED     42819    -   
netstat: no support for `AF IPX' on this system.
netstat: no support for `AF AX25' on this system.
netstat: no support for `AF X25' on this system.
netstat: no support for `AF NETROM' on this system.
Active Bluetooth connections (servers and established)
Proto  Destination       Source            State         PSM DCID   SCID      IMTU    OMTU Security
netstat: no support for `BTPROTO L2CAP' on this system.
Proto  Destination       Source            State     Channel
netstat: no support for `BTPROTO RFCOMM' on this system.


$ sudo tcpdump -vv -A
[sudo] password for dave: 
dropped privs to tcpdump
tcpdump: listening on wlo1, link-type EN10MB (Ethernet), capture size 262144 bytes
09:52:49.221170 IP (tos 0x0, ttl 55, id 5217, offset 0, flags [none], proto TCP (6), length 125)
    den02s01-in-f3.1e100.net.https > localhost.localdomain.33710: Flags [P.], cksum 0xff90 (correct), seq 413833741:413833814, ack 3161770310, win 315, options [nop,nop,TS val 2204560950 ecr 514379669], length 73
E..}.a..7.........+..........t.F...;.......
.f.6........Dgch).y".ox.,...U..h........Djj....r.!.R.oJzI/..$.?LA.Z........d9z...
09:52:49.221543 IP (tos 0x0, ttl 64, id 12057, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.33710 > den02s01-in-f3.1e100.net.https: Flags [F.], cksum 0x08c6 (correct), seq 1, ack 73, win 501, options [nop,nop,TS val 514619688 ecr 2204560950], length 0
E..4/.@[email protected]..+..........t.F...V...........
..y(.f.6
09:52:49.225340 IP (tos 0x0, ttl 64, id 5439, offset 0, flags [DF], proto UDP (17), length 71)
    localhost.localdomain.42495 > _gateway.domain: [udp sum ok] 21145+ PTR? 5.43.168.192.in-addr.arpa. (43)
E..G.?@[email protected]...+...+....5.3.oR............5.43.168.192.in-addr.arpa.....
09:52:49.227321 IP (tos 0x0, ttl 64, id 46153, offset 0, flags [DF], proto UDP (17), length 71)
    _gateway.domain > localhost.localdomain.42495: [udp sum ok] 21145 NXDomain q: PTR? 5.43.168.192.in-addr.arpa. 0/0/0 (43)
E..G.I@.@.....+...+..5...3^.R............5.43.168.192.in-addr.arpa.....
09:52:49.231085 IP (tos 0x0, ttl 64, id 5442, offset 0, flags [DF], proto UDP (17), length 73)
    localhost.localdomain.40310 > _gateway.domain: [udp sum ok] 53024+ PTR? 227.11.217.172.in-addr.arpa. (45)
E..I.B@[email protected]...+...+..v.5.59C. ...........227.11.217.172.in-addr.arpa.....
09:52:49.265963 IP (tos 0x0, ttl 64, id 46157, offset 0, flags [DF], proto UDP (17), length 111)
    _gateway.domain > localhost.localdomain.40310: [udp sum ok] 53024 q: PTR? 227.11.217.172.in-addr.arpa. 1/0/0 227.11.217.172.in-addr.arpa. PTR den02s01-in-f3.1e100.net. (83)
E..o.M@.@.....+...+..5.v.[... ...........227.11.217.172.in-addr.arpa.............5....den02s01-in-f3.1e100.net.
09:52:49.271587 IP (tos 0x0, ttl 64, id 5463, offset 0, flags [DF], proto UDP (17), length 71)
    localhost.localdomain.33612 > _gateway.domain: [udp sum ok] 63879+ PTR? 1.43.168.192.in-addr.arpa. (43)
E..G.W@[email protected]...+...+..L.5.3[8.............1.43.168.192.in-addr.arpa.....
09:52:49.273258 IP (tos 0x0, ttl 64, id 46158, offset 0, flags [DF], proto UDP (17), length 71)
    _gateway.domain > localhost.localdomain.33612: [udp sum ok] 63879 NXDomain q: PTR? 1.43.168.192.in-addr.arpa. 0/0/0 (43)
E..G.N@.@.....+...+..5.L.3...............1.43.168.192.in-addr.arpa.....
09:52:49.289081 IP (tos 0x0, ttl 55, id 5242, offset 0, flags [none], proto TCP (6), length 52)
    den02s01-in-f3.1e100.net.https > localhost.localdomain.33710: Flags [F.], cksum 0x0928 (correct), seq 73, ack 2, win 315, options [nop,nop,TS val 2204561037 ecr 514619688], length 0
E..4.z..7.........+........V.t.G...;    (.....
.f....y(
09:52:49.289168 IP (tos 0x0, ttl 64, id 12058, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.33710 > den02s01-in-f3.1e100.net.https: Flags [.], cksum 0x082a (correct), seq 2, ack 74, win 501, options [nop,nop,TS val 514619756 ecr 2204561037], length 0
E..4/.@[email protected]@..+..........t.G...W.....*.....
..yl.f..
09:52:52.994807 IP (tos 0x0, ttl 44, id 52683, offset 0, flags [DF], proto TCP (6), length 588)
    82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0xa3b8 (correct), seq 347695786:347696322, ack 4205776962, win 501, options [nop,nop,TS val 4039827458 ecr 1207355784], length 536
E..L..@.,..ER.gH..+.......j....B...........
....G........{-.5v.&.....g....t&.k....@.&p:.{...A.;....._Z..
....A...s.|.........z.S.n.1.,..c.. ....]...f...BA.@m&....a:\1...Xz.+.,.........P^ }X.T..K . ..L....V. n....X... .0....s...... :.RH.M.(...2..$.?9....>G.)5)06..$...._:<.Nz2Zq..^.&.w.........f..../....*G..FF$N*.RfL..(?.F...H..... ..*Y.....,.i.@..%.f>......@..(O....m.}i.}...<...8.'..:[email protected]..+.e.;  f.....GAZ.n....n-.x^".afsR...%..e...3.9.a.......R...r...
!.. .z..\s..".............}%..?.:.`..GA7..T.kM...2......xx......'..-mJ...e.....p.......VRO;+.......5.w{..L.b%..Jv........`....T
09:52:52.994941 IP (tos 0x0, ttl 64, id 38645, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x5f9e (correct), seq 1, ack 536, win 762, options [nop,nop,TS val 1207361810 ecr 4039827458], length 0
E..4..@[email protected]..+.R.gH.......B..l....._......
G.......
09:52:53.001866 IP (tos 0x0, ttl 64, id 6726, offset 0, flags [DF], proto UDP (17), length 72)
    localhost.localdomain.34678 > _gateway.domain: [udp sum ok] 43806+ PTR? 72.103.165.82.in-addr.arpa. (44)
E..H.F@[email protected]...+...+..v.5.4.?.............72.103.165.82.in-addr.arpa.....
09:52:53.006443 IP (tos 0x0, ttl 64, id 46924, offset 0, flags [DF], proto UDP (17), length 72)
    _gateway.domain > localhost.localdomain.34678: [udp sum ok] 43806 NXDomain q: PTR? 72.103.165.82.in-addr.arpa. 0/0/0 (44)
E..H.L@.@.....+...+..5.v.4)..............72.103.165.82.in-addr.arpa.....
09:52:59.715841 IP (tos 0x0, ttl 44, id 52684, offset 0, flags [DF], proto TCP (6), length 588)
    82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0x0289 (correct), seq 536:1072, ack 1, win 501, options [nop,nop,TS val 4039834165 ecr 1207361810], length 536
E..L..@.,..DR.gH..+.......l....B...........
...5G.........  .-Zw=.6#802...V
`G..a.WRT.<..........,.wtl\...48Zl....6.i..e.g.dL...S...|L>oN.\..4..z.z.7"a...'zA.Z....7+?Q....Y.?'Bcu.#.%.D....:.,..."....3...W.D2.Y8..8..+.........Ue..>l..........3.0.4.tcLe..Q....Oy..e....B./U5..jh.....Gdv..K....n...i.z............V[F.J.C..Z~F..J
e.e^>
.w*.0g........C+.y?...._.....5(.....I..7-............'4.X.s..;.<p.2r.q.....C.r..C{.q...LA.....9g...HI...3..A......
cN1..:.%@...Kt{......
8c..%..N."...6..G....lX...v...f.0..9...S`n/G....J...>.G..o...{u...I........+...e.p.....-................G....v...Tn...T.
09:52:59.715967 IP (tos 0x0, ttl 64, id 38646, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x2912 (correct), seq 1, ack 1072, win 762, options [nop,nop,TS val 1207368531 ecr 4039834165], length 0
E..4..@[email protected]..+.R.gH.......B..n.....)......
G..S...5
09:53:01.331562 IP (tos 0x0, ttl 64, id 42377, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.58794 > den02s02-in-f14.1e100.net.https: Flags [.], cksum 0x9c11 (correct), seq 941105926, ack 2407933939, win 501, options [nop,nop,TS val 3918337418 ecr 796134296], length 0
E..4..@.@.....+.........8.#...'............
..../t..
09:53:01.338695 IP (tos 0x0, ttl 64, id 6950, offset 0, flags [DF], proto UDP (17), length 72)
    localhost.localdomain.47838 > _gateway.domain: [udp sum ok] 11291+ PTR? 14.12.217.172.in-addr.arpa. (44)
E..H.&@[email protected](..+...+....5.4V.,............14.12.217.172.in-addr.arpa.....
09:53:01.395143 IP (tos 0x0, ttl 64, id 48250, offset 0, flags [DF], proto UDP (17), length 111)
    _gateway.domain > localhost.localdomain.47838: [udp sum ok] 11291 q: PTR? 14.12.217.172.in-addr.arpa. 1/0/0 14.12.217.172.in-addr.arpa. PTR den02s02-in-f14.1e100.net. (83)
E..o.z@.@.....+...+..5...[..,............14.12.217.172.in-addr.arpa..................den02s02-in-f14.1e100.net.
09:53:01.399966 IP (tos 0x0, ttl 118, id 63042, offset 0, flags [none], proto TCP (6), length 52)
    den02s02-in-f14.1e100.net.https > localhost.localdomain.58794: Flags [.], cksum 0x9cf8 (correct), seq 1, ack 1, win 269, options [nop,nop,TS val 796181908 ecr 3918289806], length 0
E..4.B..v.........+.......'.8.#............
/t....[.
09:53:02.151026 IP (tos 0x0, ttl 44, id 52685, offset 0, flags [DF], proto TCP (6), length 588)
    82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0x249d (correct), seq 1072:1608, ack 1, win 501, options [nop,nop,TS val 4039836587 ecr 1207368531], length 536
E..L..@.,..CR.gH..+.......n....B....$......
....G..S.......}{.'..F ....w.#;X....a..7.2..&......S.i./.#. .df...Y..M.+.....O......Q.. .6{....Q1J...7,..C.s..kY.=....?.h(....(..2Q...r.S...4.G3.}....^s....k.x&.....wk..MHms.g.h.......V..........Vx...b..^C.....E..mD..V.7f8YE..q#.T.V..,T....t/.......Y......    .tf`.Ld..?6'...S<0.q_u..#.tO38....  ....g.~..&r$5sXo.a.....:H...L.7 ....>h.q=..u.n|.S.......h...A}%.1...+l.......-...VWU*.<.....a.[ .O.fJ.M ...
..7.3paz.+......-.r...}..G. |.7....1^.z..F......    [email protected].#.H.-d...E)....1..........E.N[.q.D1..3..}..]..e.l.l.>)j.4.q.....x...D..h}....
09:53:02.151147 IP (tos 0x0, ttl 64, id 38647, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x1401 (correct), seq 1, ack 1608, win 762, options [nop,nop,TS val 1207370966 ecr 4039836587], length 0
E..4..@[email protected]..+.R.gH.......B..p............
G.......
09:53:04.643208 IP (tos 0x0, ttl 64, id 38648, offset 0, flags [DF], proto TCP (6), length 1394)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0x33b0 (correct), seq 1:1343, ack 1608, win 762, options [nop,nop,TS val 1207373458 ecr 4039836587], length 1342
E..r..@.@.....+.R.gH.......B..p.....3......
G.............r. ..'...N?1...q...EK>g.. .....v...u...=5....rDZpq...m....|....3...1o.Zs.k....6.....kQ....bw...J.~i..Q.......a.C.T^.en..eF<.>.d.Of1.5.l........^.,..<r.....i.......B3......W:..\...I.....}..j.......q.fctG...R.9..c.  Fx..9..q..&..._..z.KP.R..)..-7M.c...b........(].........!_...IG....=B.{jmH....XUB
5.qfV..p ..Z.......@.............'e.... .^..!"..[L...&r-.....).q..|r.yO.w.xxhh...............~.b..o.. ......h:@.P.....J..j...   `...............w...m.'..._t.w..K..#...^m .G.m..e...89..!........... ...".
a._..#...2..Y.....\..S3&.<.mkz..8...Fn=[H.$.R.HI..YB.@H.=K.U...t....a b.vK...9.g.V....q.Q<.3.2.8......g.V....O..y1.:.VR..O....ks~Qq....
.:.y.   ..$.U...F.....O..3o-./.~._y.P..D...;...Z......G..#!-...!...............P.#<....%...+../......A(.BU .....c.!..........~#.&zc...z..K.a.^........nO,...On;yT)...q...>G..v|c}.d.f...a.N.5..E......_.|..k.l......:........z-r.......Nap....>.9?.5#C..5f.t.....l..."J_.n.....lY..v..$hej.*}...cj......$.5........S/.!.D."uW..t.M..!et......{_?0+U...s..K.q).Igr.....\..,......V....A.....7.....bE.w[11."..:..i.Gz...xZv..U%...-<~.Y6eJ.:p.,....W..,......sk>1J.!"9..]..Z$....Z.._....{@.F..-..L8.z...u..v..3Q..)>s.......\...1.....]...'f.w.3...vK...... ..c0...}..S.p.|..<g%&...4!.[h)..T....F....J%.... ...c...B.....`....."..,..\tHyz|..8SD..}........+h...=Z..J..E..%t.K>....K.(..26..........    ....M.T..c2f}.P.t+. ..R...S.i
09:53:04.643260 IP (tos 0x0, ttl 64, id 38649, offset 0, flags [DF], proto TCP (6), length 788)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [P.], cksum 0xfa89 (correct), seq 1343:2079, ack 1608, win 762, options [nop,nop,TS val 1207373458 ecr 4039836587], length 736
E.....@[email protected]..+.R.gH..........p............
G..........dg.qf...5k..[....uw.s.......E..s...?'..*.D..'[email protected].}...g.l.'.B}.Tf.k.D) ..!+I.......p...|...+R*>.....c%M>.;...........l. O..0..w`.$=.u.7.s.....Xr....-.U.:..;...^...F.U"YN]....&...:B\W.W.....a...^..v+.......k_......o.....fp...tKw.[&.-O....'.0./...DMk...#.9A_8. (....    ..o.[-..m.........p.X.....LQ4M.0....B~..........%....%.9.uXi..1...p.7PC.c..~.k.xzr.....t0.D..e@QhU....  ...K.,1...dO......W.hW.C.s....(.^.b6.........E.6]..^...c..QY.%.cs...,. .kj.......'.".th\b..O.B.........'.jv..5..'4 .^...v6...d.u.......C.........|..^w.../))..|....<i....H1..e.(.....
.>.L....9....D].~.n<...G].20.R,Q..=&..y...W+.......x.&.b....5.........o+...Y.   .Y........AW M*.e.4`..T........G..:f.s..T...C....3$.!....l..eU....K..P...)..a..`.T.&~W.
09:53:04.731655 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has localhost.localdomain tell _gateway, length 28
...........KL...+.........+.
09:53:04.731705 ARP, Ethernet (len 6), IPv4 (len 4), Reply localhost.localdomain is-at 10:0b:a9:4e:f4:48 (oui Unknown), length 28
...........N.H..+....KL...+.
09:53:04.847887 IP (tos 0x0, ttl 44, id 52686, offset 0, flags [DF], proto TCP (6), length 52)
    82.165.103.72.https > localhost.localdomain.59018: Flags [.], cksum 0xfb5f (correct), seq 1608, ack 1343, win 501, options [nop,nop,TS val 4039839319 ecr 1207373458], length 0
E..4..@.,..ZR.gH..+.......p.........._.....
...WG...
09:53:04.848003 IP (tos 0x0, ttl 44, id 52687, offset 0, flags [DF], proto TCP (6), length 52)
    82.165.103.72.https > localhost.localdomain.59018: Flags [.], cksum 0xf884 (correct), seq 1608, ack 2079, win 496, options [nop,nop,TS val 4039839319 ecr 1207373458], length 0
E..4..@.,..YR.gH..+.......p....`...........
...WG...
09:53:04.857146 IP (tos 0x0, ttl 44, id 52688, offset 0, flags [DF], proto TCP (6), length 588)
    82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0xaf5b (correct), seq 1608:2144, ack 2079, win 501, options [nop,nop,TS val 4039839328 ecr 1207373458], length 536
E..L..@.,[email protected]..+.......p....`.....[.....
...`G.........F..5H......%.......=.^0.  ..U...P.EQ..,Ru.<..48.k...HI.X~...
0.0F6;]...I4-..qP../..|."...@.}o.k.../.!C.c.....!.......z..e"AJ..?`...: ..x.n..8o.<*J.f<..NW.....f.~....XS..
.Iwf..~...Y..D2.Y.b.`......:q....ZG...=......2....$......S..F...6..A..Q_s..Z).*..._.b&.`.....R;.r...!_-`...Nf/...7..%+.'.....p......K.].PB......H................m......Ij.F|...K...*A.......|.UyP...~;..}..}WB%{+..g
. V"..........%..-......Z..\H.....'=..P...9..[...|v..y...V.....R...I...L...Y.....I......K.....:..o..>7....Z......j..;....b.W...6.c9g....J1e..l.h3-.
09:53:04.857263 IP (tos 0x0, ttl 64, id 38650, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [.], cksum 0xf483 (correct), seq 2079, ack 2144, win 762, options [nop,nop,TS val 1207373672 ecr 4039839328], length 0
E..4..@.@.....+.R.gH.......`..s
...........
G..h...`
09:53:04.858672 IP (tos 0x0, ttl 64, id 38651, offset 0, flags [DF], proto TCP (6), length 588)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [P.], cksum 0xd966 (correct), seq 2079:2615, ack 2144, win 762, options [nop,nop,TS val 1207373674 ecr 4039839328], length 536
E..L..@.@.....+.R.gH.......`..s
.....f.....
G..j...`.......w...Pa.. -...8....i..+8.na..5.d..)...qMU.........L..~.k...5......L4...../.;....,......<.Q.].(Nl.O.N..zD...}..6....U../\.g.....Y....!n.u..`..A...zc.....[..E.......x....(.'..W.$..............r..........C...~    <....LL..G.`..;.z|.......qBAm%Nf..Gt..m.....2..u...L....lG..A..lC..b.X&.....(..#.Q....T.{`.:..{.e
...!$.'.(<&v......d..Qb.."b.#......~MD..O..#....H.T...:T..>..r>....Q..xI....|6mG.77..DrQ..OtQ..2..[...Pf'.......{a..:dq_;;..Q..O.o.q.0.|u.U..N1....O..+..G....C...L..;a...Y...^(+..o.U.=...`.......;.?.......O....8..3..|;.o.:..A
09:53:05.027720 IP (tos 0x0, ttl 44, id 52689, offset 0, flags [DF], proto TCP (6), length 588)
    82.165.103.72.https > localhost.localdomain.59018: Flags [P.], cksum 0x5d6e (correct), seq 2144:2680, ack 2615, win 501, options [nop,nop,TS val 4039839499 ecr 1207373674], length 536
E..L..@.,..?R.gH..+.......s
...x....]n.....
....G..j..........0.........B..g.j.Ha=f..................'.&....;lk..Z...^q......X.\.....v........zu{..+gI.X.K5;T..Vfs|...l..d..............Y.f7.v......gr.q....`.`...O....K.XG].t.Q..B...cXxw.....Xo:H..r$....L u.$<...iL.B)CY.:....L...i(9.b.. /.%....O...805....nW'....n...t8D..x.b..........w...'.yh..J#5..7.=.l..Yx~.)....`I3.2O<....#.x.....).nf.[.b. #.m....h..3...
.(vV..~?SI8..x.9b.*.!..Yp.y...4#...>......N.A.....r_... 9N.th.x....;F*.............w/...v.....|.p......uX....!...i..Y..S.3x.r."VU{......1)L.h...8...L$.F.o].Y5a*...FPF.q .Lr.....
...
09:53:05.029099 IP (tos 0x0, ttl 64, id 38652, offset 0, flags [DF], proto TCP (6), length 588)
    localhost.localdomain.59018 > 82.165.103.72.https: Flags [P.], cksum 0xff8b (correct), seq 2615:3151, ack 2680, win 762, options [nop,nop,TS val 1207373844 ecr 4039839499], length 536
E..L..@.@.....+.R.gH.......x..u"...........
G............6......@.!.L[2s.....P.G.c..P...uk....G.f=x.<..K.....u...\....<AU......o...oV...../....J..gw.2TNG.......H_....V.x.e."...w.._.Yg.a..K1..H'.0.u`..1.i...7...\Nh.|...g.i=X%..e.:.e$...=.:mH

1 Answer 1

1

Run netstat as user root

The netstat output shows one TCP session that is generating traffic seen in tcpdump:

tcp        0      0 192.168.43.5:59018      82.165.103.72:443       ESTABLISHED -

You should run the netstat command as user root to display the PID and process name of the process that establishes this TCP session.

Trace network activity of the process

Once you have the PID, you may want to investigate more thoroughly the network traffic generated by the process using:

strace -f -e trace=network -p <PID>

Disable tcpdump addresses conversion

Also, in order to better compare the tcpdump output with the netstat one, you may want to execute tcpdump with the -n option to disable conversion of addresses to names:

       -n     Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .