This is a kludge and not a real solution; however, it solved my problem. If someone posts a better solution I will accept that. Since I do not know what programs on my machines are initiating the traffic, I decided to block the IP addresses they were connecting to.
These are the steps I took:
- Install Wireshark
- In the menu for Wireshark under "View | Name Resolution", check "Resolve Network Addresses". This helps later on to find all IP addresses associated with a domain name.
- Successfully capture the unwanted network traffic with Wireshark, and note the domains that appear in the source and destination columns.
- For each domain, such as
example.com, execute the command
host example.com. This will list all IPv4 and IPv6 addresses that resolve to that domain name, and thus these are all the addresses that need to be blocked.
- For each IPv4 address
foo, run as root
iptables -I INPUT -s foo -j DROP.
- For each IPv6 address
bar, run as root
ip6tables -I INPUT -s bar -j DROP.
To unblock the addresses, run as root
iptables -D INPUT -s foo -j DROP or
ip6tables -D INPUT -s bar -j DROP if the address is an IPv6 address. Alternatively, simply reboot the machine to unblock the addresses - the effect of the iptables commands does not persist across reboots. I recommend collecting the commands to block and unblock the addresses into two shell scripts for convenience.
In my specific case, I found that my desktop was connecting to
The first two domains appear to be used to select the best mirror of the Fedora repositories to connect to, the Google domain presumably is from checking for updates to Chrome, and the final domain, which was responsible for most of the traffic, is a mirror of Fedora 26. This confirms my guess that the traffic was from checking for software updates. I have used this solution for a day thus far with success.