I' watching the system monitor. I've got nothing opened, no browser or email client. I see that i'm still receiving about 18 KB/s. Is there any way to find out what program is asking for it or what site or IP it's coming from?
I suggest that you enable
ufw, the default firewall.
sudo ufw enable
Now enable logging:
sudo ufw logging high
Now you can check the system logs for details:
cat /var/log/syslog | grep -i ufw
You may see an entry like this:
Apr 6 10:54:24 T440p kernel: [151434.303127] [UFW AUDIT] IN= OUT=wlp3s0 SRC=192.168.0.120 DST=126.96.36.199 LEN=1086 TOS=0x00 PREC=0x00 TTL=64 ID=40870 DF PROTO=TCP SPT=54590 DPT=443 WINDOW=1136 RES=0x00 ACK PSH URGP=0
Then you can check the identity:
sudo apt-get update sudo apt-get install whois whois 188.8.131.52
And the response is, in part:
OrgName: Dropbox, Inc. OrgId: DROPB Address: 333 Brannan Street City: San Francisco StateProv: CA PostalCode: 94107 Country: US
So that suggests that, even though no browser or email program is open, I have Dropbox installed and it is communicating any changes to my Dropbox folders.
Be careful, with logging set to high, large log files will build up fast. I recommend that, after you've made your checks, change the logging back to low or off:
sudo ufw logging off