Hourly events in the firewall-log, originating from Ubuntu12.04-box. How to find the reason? [duplicate]

Question

Possible Duplicate:
How do I disable Online Videos in the Unity Dash?

every hour, the logfile on our firewall (IPCop 1.4.20, 192.168.1.8) lists nine lines, apparently caused by my Computer (Ubuntu 12.04, 192.168.1.55):

Jan  8 08:01:16 ipc9 kernel: NEW not SYN? IN=eth0 OUT= MAC=00:04:06:08:0b:03:00:0c:0e:05:07:01:01:00 SRC=
192.168.1.55 DST=192.168.1.8 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36594 DF PROTO=TCP SPT=44474 DPT=800 WIN
DOW=37960 RES=0x00 ACK FIN URGP=0 
...

Jan  8 08:02:08 ipc9 kernel: NEW not SYN? IN=eth0 OUT= MAC=00:04:06:08:0b:03:00:0c:0e:05:07:04:08:00 SRC=
192.168.1.55 DST=192.168.1.8 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=36602 DF PROTO=TCP SPT=44474 DPT=800 WIN
DOW=37960 RES=0x00 ACK FIN URGP=0 

I have no idea how to find the cause of these entries. /etc/cron.hourly is empty.

root@ubb-55:~# netstat -tulpen
Aktive Internetverbindungen (Nur Server)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode       PID/Program name
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      0          8994        940/dnsmasq     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      0          8042        685/sshd        
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      0          79057       777/cupsd       
tcp6       0      0 :::22                   :::*                    LISTEN      0          8044        685/sshd        
tcp6       0      0 ::1:631                 :::*                    LISTEN      0          79056       777/cupsd       
udp        0      0 127.0.0.1:53            0.0.0.0:*                           0          8993        940/dnsmasq     
udp        0      0 0.0.0.0:68              0.0.0.0:*                           0          8612        910/dhclient    
root@ubb-55:~# 

How can one find out, which service or whatever is causing these packets every hour?

Thanks, Robert

Answer 1

I found this Q&A and removed unity-scope-video-remote. Seems as if this was the solution to prevent my computer from sending the offending packets. I still would like to know what would be the 'clean' way to find unnecessary/unwanted services/processes and to deactivate them.

Answer 2

Probably not the best way but you could use wireshark on the dot55 box with the capture filter set to the ip address of the ipcop.

Fire up wireshark then go to the Capture tab /Options/Capture Filters, click on ip address 192.168.0.1

on the filter string, change the 192.168.0.1 ip to ip address of the ipcop

host 192.168.1.8

After you capture the offending packet click the analyze tab and then click follow tcp stream. That should give you a clue.