As soon as i start the computer it connects to a lot of different connections over internet, even when I haven't opened the browser. The screenshot from etherape is attached for better understanding

My internet connction has slowed down in the last few days so i checked and found these connections I am using ubuntu 12.04.

  • Does it mean my ubuntu installation is affected by some malware / virus
  • or is it ok to have such connections?
  • Does it affect my internet connection speed?

enter image description here


You can also know what program is launching those connection using this command

sudo netstat -tup

It will give you something like this

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State           PID/Program name    
tcp        0      0 mypc:55541              db3msgr5011103.gat:msnp ESTABLISHED     4884/pidgin         
tcp        0      0 mypc:59350              we-in-f16.1e100.n:imaps ESTABLISHED     2919/thunderbird    

In this example you can see pidgin and Thunderbird open some connections.


Install the following tools and check what IP's they are. But as I'm getting something fishy.

Chkrootkit - chkrootkit can be used to help determine if a machine has been compromised. While not what you should use for the 'final word' on if you have been compromised, it runs a lot of useful checks and can direct suspicions towards finding a solution. To install chkrootkit install the chkrootkit package.

Rkhunter (Ubuntu 6.06 and above only) - another rootkit detection software. Install the rkhunter package from the Universe Repository.

tiger - Tiger is a package consisting of Bourne Shell scripts, C code and data files which is used for checking for security problems on a UNIX system. It scans system configuration files, file systems, and user configuration files for possible security problems and reports them. Install tiger chkrootkit john.

denyhosts (Ubuntu 6.10 and above only) - scans your SSH logs to find brute-force attacks, and then blocks the IPs they came from. To install denyhosts install the denyhosts package.

you must know them what they are and then only you can sort out them.

Install the above tools with from terminal or software centre.

If you would like to go from terminal , do like

sudo apt-get install chkrootkit rkhunter tiger denyhosts

you must read the Documentation of those tools to have a better understand on their usage.

I found some helpful links for you: Rootkit Detection ,Server Security & Tiger

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.