Strange & constant network activity

sangheeta

Hello,

I have 3 pc's, 2 with mate and 1 with Budgie, and I've noticed recently that when a web browser is open, there is a little constant activity on the network, _3kb up & down every 5 sec. When I exit any browsers, this traffic stops.

I also use qBittorrent and when I exit the application after pausing my shares, there is still a little activity on the network. I have to log out/in my session for everything to stop.

I see it with the mate and gnome monitor, and the system monitor applets of mate. All happens with 4 web browsers I use, vivaldi stable & snapshot, firefox & nightly opened and qBittorrent closed. I also tried to reset my browsers and start a new config folder without success, even with no browsing, this happens all the time.

I don't understand why this happens, and I don't remember this a month ago.
Any ideas?
Thank you

kyrios

sangheeta These are applications checking if the internet connection is up in firefox, you can go in about:config and check the value of network.http.keep-alive.timeout

Regarding wireshark, perhaps you should read the doc
https://getsol.us/articles/software/wireshark/en/

CorvusRuber

Have you tried to go the heavy handed way with Wireshark ?

sangheeta

Thanks CorvusRuber, I really don't know nothing about network, but I installed wireshark, checked and some lines are red:

Also an error running wireshark without sudo:

CorvusRuber

Well, if you don't know much about networks Wireshark is overkill (the error is fine, wireshark needs elevated privileges to look where it needs to look).
Another kind of approach could be using ufw: you install it, create a "tabula rasa" rule that blocks each and every tipe of connection (both inbound and outbound) and then check the logs (/var/log/ufw.log or something like that) with one browser open. It's a pretty tedious way to check, but in that log you should find every connection attempt made by the browser, including the repeating ones.
Disable the general rule after the check and you're back to normal, after that should be fairly easy to create specific rules to block unwanted traffic.
Last test: install a completely new and unused browser (I don't know, falkon maybe) and check if even that has the same behavior.

sangheeta

I did uninstall and reinstall vivaldi and start an empty config folder, network activity was here, with new profile on start page, even after 30mn. Tried to delete internet connexion profile and reboot, same.

So I guess it is an hardware issue about my setup, my internet box (from france, freebox mini 4K, my wall ethernet plugs over AC...) but, yesterday I made a fresh install of solus plasma on a brand new ssd, after first boot, checking with firefox, all was ok but after eopkg up to update the system and the second boot, this problem was here again.

sangheeta

well, I think I found the solution, I did this morning a big reset of all my network connection devices, ethernet wall plugs, internet box and everything seems to be solved, I have a much more consistent network activity. This explains that even with a fresh install of solus, it was not working.

I'm sick of it, all the problems I have with solus, well it's always my fault! 🤣

kyrios

sangheeta I did this morning a big reset of all my network connection devices, ethernet wall plugs, internet box and everything seems to be solved,

All these aren't solus btw 😛

stalebrim

You can see your open ports with lsof -i -P -n

brent

A 3KB hiccup seems negligible between chatty browsers, an os checking for updates, etc. but I can see why it drove you crazy: a persistent 5 second spike is like water torture...seems more a network glitch to me than something sinister. So a complete reboot/reset of all components did the trick? Congrats.
Still the ufw advice and the isolating the port via lsof (see post above) will zero in on it if it happens again.