For a little while now, a strange connection has been showing up on my netstat made by the command:

/usr/lib/gvfs/gvfsd-http --spawner :1.1 /org/gtk/gvfs/exec_spaw/2 

By the time I notice it, the connection is always at the closed state. Every time I trace the IP address, it usually says that no website is registered.

I am unsure what activated this. It could be one of my browsers (Chrome and Firefox). I'm getting a little worried about this.

Could someone clue me in to what this could possibly be, and how to prevent the connection.

4 Answers 4


If the command

sudo watch netstat -tonp

shows a lot of connections caused by gvfs directly after booting, then you can consider to remove zeitgeist, geoclue, and/or ubuntu-one. You can also consider to deactivate the rhythmbox lastfm-plugin. As I don't need these programs I decided to remove them all and after the next boot, all strange gvfs connections disappeared.

The following page shows you how to remove some of these applications.


Be aware, that Zeitgeist is an essential part of Unity! So don't remove it, if you are using Unity.


gvfsd is your Gnome Virtual File System. There is a fairly old bug that causes it to leave connections in the CLOSE_WAIT state for an undefined amount of time. It seems to be more an issue with RhythmBox more than another other program I've seen.

Some sources:

Ubuntu forums

Ubuntu forums 2


This will help you I think, so take a look:

  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Apr 29, 2015 at 13:24

I found that gvfsd-http was connecting to a server called backoo.canonical.com

tcp  |  1  |  |  backoo.canonical.com:www LAST_ACK

This was an IP-address of: It would show up whenever I ran netstat -tu.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .