Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Possible Duplicate:
How do I disable Online Videos in the Unity Dash?

every hour, the logfile on our firewall (IPCop 1.4.20, 192.168.1.8) lists nine lines, apparently caused by my Computer (Ubuntu 12.04, 192.168.1.55):

Jan  8 08:01:16 ipc9 kernel: NEW not SYN? IN=eth0 OUT= MAC=00:04:06:08:0b:03:00:0c:0e:05:07:01:01:00 SRC=
192.168.1.55 DST=192.168.1.8 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36594 DF PROTO=TCP SPT=44474 DPT=800 WIN
DOW=37960 RES=0x00 ACK FIN URGP=0 
...

Jan  8 08:02:08 ipc9 kernel: NEW not SYN? IN=eth0 OUT= MAC=00:04:06:08:0b:03:00:0c:0e:05:07:04:08:00 SRC=
192.168.1.55 DST=192.168.1.8 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36602 DF PROTO=TCP SPT=44474 DPT=800 WIN
DOW=37960 RES=0x00 ACK FIN URGP=0 

I have no idea how to find the cause of these entries. /etc/cron.hourly is empty.

root@ubb-55:~# netstat -tulpen
Aktive Internetverbindungen (Nur Server)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      0          8994        940/dnsmasq     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          8042        685/sshd        
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      0          79057       777/cupsd       
tcp6       0      0 :::22                   :::*                    LISTEN      0          8044        685/sshd        
tcp6       0      0 ::1:631                 :::*                    LISTEN      0          79056       777/cupsd       
udp        0      0 127.0.0.1:53            0.0.0.0:*                           0          8993        940/dnsmasq     
udp        0      0 0.0.0.0:68              0.0.0.0:*                           0          8612        910/dhclient    
root@ubb-55:~# 

How can one find out, which service or whatever is causing these packets every hour?

Thanks, Robert

share|improve this question

marked as duplicate by qbi, Ringtail, Jorge Castro, gertvdijk, Eliah Kagan Jan 18 '13 at 23:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

2 Answers 2

I found this Q&A and removed unity-scope-video-remote. Seems as if this was the solution to prevent my computer from sending the offending packets. I still would like to know what would be the 'clean' way to find unnecessary/unwanted services/processes and to deactivate them.

share|improve this answer
add comment

Probably not the best way but you could use wireshark on the dot55 box with the capture filter set to the ip address of the ipcop.

Fire up wireshark then go to the Capture tab /Options/Capture Filters, click on ip address 192.168.0.1

on the filter string, change the 192.168.0.1 ip to ip address of the ipcop

host 192.168.1.8

After you capture the offending packet click the analyze tab and then click follow tcp stream. That should give you a clue.

share|improve this answer
    
Thank you for this tip. I had no experience with wireshark, but I got it installed and running by now. (Had to run "dpkg-reconfigure wireshark-common" and then add myself to the group 'wireshark') With the filter 'host 192.168.1.8' it captured too much traffic, so I tried a filter 'tcp port 800'. A test with 'telnet 192.168.1.8 800' worked (wireshark captured packets), but then I had to leave, and this morning I found, that wireshark had not captured the offending packets. I'm still experimenting... –  user119665 Jan 9 '13 at 9:19
    
Wireshark results indicated, that the problem had something to do with Ubuntu Videosearch. (askubuntu.com/questions/155331/…) has helped. –  user119665 Jan 14 '13 at 15:24
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.