3

I am using ubuntu 14.04. Recently I started noticing that my system was uploading and downloading something in the background(I did not initiate this). The upload and download speeds were quite high and also equal. See screenshot below from network monitor: enter image description here

I installed nethogs and tried to catch the culprit but then I got something weird from that as well.

PID USER PROGRAM
 ?  root 172.xx.yy.96:34716-31.13.78.35:443

I tried to check for the program using the port but the following did not give any output:

suhas:~$ sudo netstat -nlp | grep 34716
suhas:~$ sudo lsof -n -P -i +c 13 | grep "34716"
suhas:~$ fuser 34716/tcp

And guess what the ip 31.13.78.35 means. Facebook(https://31.13.78.35:443). I really don't understand what is going on. I have tried stopping all programs which were running but that did not seem to have any effect on the upload/download. It goes on for some time and stops on its own.

Edit: tcptrack screenshot(port 35740): enter image description here

  • try tcptrack -i <eth0 or wlan0> – Ipor Sircer Aug 29 '16 at 10:44
  • I installed tcptrack. Will use it the next time I notice this happening. Thanks. – Suhas K Aug 29 '16 at 10:45
  • Not able to determine anything using tcptrack :(. Have the following output from tcptrack: Client - 172.xx.yy.96:35740 | Server - 31.13.78.35:443 | State - RESET | Idle - 0s | Speed - 0B/s – Suhas K Aug 29 '16 at 11:38
  • if the connection is not tcp, then try iptraf. – Ipor Sircer Aug 29 '16 at 11:40
  • I am confused. The port in question(35740) does appear in tcptrack. But the state and speed seem to be wrong. Will iptraf help? – Suhas K Aug 29 '16 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.