I' watching the system monitor. I've got nothing opened, no browser or email client. I see that i'm still receiving about 18 KB/s. Is there any way to find out what program is asking for it or what site or IP it's coming from?


I suggest that you enable ufw, the default firewall.

sudo ufw enable

Now enable logging:

sudo ufw logging high

Now you can check the system logs for details:

cat /var/log/syslog | grep -i ufw

You may see an entry like this:

Apr 6 10:54:24 T440p kernel: [151434.303127] [UFW AUDIT] IN= OUT=wlp3s0 SRC= DST= LEN=1086 TOS=0x00 PREC=0x00 TTL=64 ID=40870 DF PROTO=TCP SPT=54590 DPT=443 WINDOW=1136 RES=0x00 ACK PSH URGP=0

Then you can check the identity:

sudo apt-get update
sudo apt-get install whois

And the response is, in part:

OrgName:        Dropbox, Inc.
OrgId:          DROPB
Address:        333 Brannan Street
City:           San Francisco
StateProv:      CA
PostalCode:     94107
Country:        US

So that suggests that, even though no browser or email program is open, I have Dropbox installed and it is communicating any changes to my Dropbox folders.

Be careful, with logging set to high, large log files will build up fast. I recommend that, after you've made your checks, change the logging back to low or off:

sudo ufw logging off 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.