Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How do I disable Online Videos in the Unity Dash?

every hour, the logfile on our firewall (IPCop 1.4.20, lists nine lines, apparently caused by my Computer (Ubuntu 12.04,

Jan  8 08:01:16 ipc9 kernel: NEW not SYN? IN=eth0 OUT= MAC=00:04:06:08:0b:03:00:0c:0e:05:07:01:01:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36594 DF PROTO=TCP SPT=44474 DPT=800 WIN
DOW=37960 RES=0x00 ACK FIN URGP=0 

Jan  8 08:02:08 ipc9 kernel: NEW not SYN? IN=eth0 OUT= MAC=00:04:06:08:0b:03:00:0c:0e:05:07:04:08:00 SRC= DST= LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36602 DF PROTO=TCP SPT=44474 DPT=800 WIN
DOW=37960 RES=0x00 ACK FIN URGP=0 

I have no idea how to find the cause of these entries. /etc/cron.hourly is empty.

root@ubb-55:~# netstat -tulpen
Aktive Internetverbindungen (Nur Server)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0  *               LISTEN      0          8994        940/dnsmasq     
tcp        0      0    *               LISTEN      0          8042        685/sshd        
tcp        0      0 *               LISTEN      0          79057       777/cupsd       
tcp6       0      0 :::22                   :::*                    LISTEN      0          8044        685/sshd        
tcp6       0      0 ::1:631                 :::*                    LISTEN      0          79056       777/cupsd       
udp        0      0  *                           0          8993        940/dnsmasq     
udp        0      0    *                           0          8612        910/dhclient    

How can one find out, which service or whatever is causing these packets every hour?

Thanks, Robert

share|improve this question

marked as duplicate by qbi, Ringtail, Jorge Castro, gertvdijk, Eliah Kagan Jan 18 '13 at 23:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

I found this Q&A and removed unity-scope-video-remote. Seems as if this was the solution to prevent my computer from sending the offending packets. I still would like to know what would be the 'clean' way to find unnecessary/unwanted services/processes and to deactivate them.

share|improve this answer

Probably not the best way but you could use wireshark on the dot55 box with the capture filter set to the ip address of the ipcop.

Fire up wireshark then go to the Capture tab /Options/Capture Filters, click on ip address

on the filter string, change the ip to ip address of the ipcop


After you capture the offending packet click the analyze tab and then click follow tcp stream. That should give you a clue.

share|improve this answer
Thank you for this tip. I had no experience with wireshark, but I got it installed and running by now. (Had to run "dpkg-reconfigure wireshark-common" and then add myself to the group 'wireshark') With the filter 'host' it captured too much traffic, so I tried a filter 'tcp port 800'. A test with 'telnet 800' worked (wireshark captured packets), but then I had to leave, and this morning I found, that wireshark had not captured the offending packets. I'm still experimenting... – user119665 Jan 9 '13 at 9:19
Wireshark results indicated, that the problem had something to do with Ubuntu Videosearch. (…) has helped. – user119665 Jan 14 '13 at 15:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.