1

I noticed abnormal network activity when trying to test something and I can't find what program is the culprit.

Wireshark: wireshark log

My local IP is 192.168.100.5

I tried to inspect with sudo netstat -latpen and sudo lsof -i but there's no trace of it. Only on sudo iftop -pPl and sudo pktstat -i enp7s0 -nt works but it's not revealing what process is sending pings.

iftop:

iftop log

This can be seen using sudo tcpdump ip proto \\icmp command but that's all, I can't see this on any other tool. And I inspected all programs that could use it. I have UFW enabled and blocking port 7759 (IPv4/IPv6) but it doesn't work.

How could I locate the program that sends all these pings?

Improve this question
3
  • See also curl http://node-241.cheese-onion.nl which may give a hint, possibly?
    – Kusalananda ♦
    Sep 10, 2022 at 8:27
  • Looks like it's a protocol associated with Tribler which is a torrent and onion routing related tool. I wouldn't be surprised that this protocol triggers connections from unknown peers just like any torrent download would. OP could give more feedback about its use. To check which tool: as root (ie: on Ubuntu use sudo): ss -aunp sport == 7759 (your netstat checked TCP while it's UDP).
    – A.B
    Sep 10, 2022 at 8:52
  • @A.B I guess you're right, I have Tribler installed. The strange thing is that it's not running at all! I installed it as Flatpak without background permission and somehow still this is running (but also there's no Tribler process or something related to it). There's a way to stop this?
    – weirdnoddle
    Sep 11, 2022 at 1:04

1 Answer 1

Reset to default
1

Try using iptables instead of ufw. UFW works at the software level, where IPTables works at the kernel level:

Run these commands in a terminal:

/sbin/iptables -A INPUT -p tcp -m multiport --dports 7759,7760 -j DROP
/sbin/iptables -A INPUT -p tcp -m multiport --sports 7759,7760 -j DROP
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.