Questions[nethogs](ubuntu)

Using NetHogs on an Ubuntu 16.04 (web) server, i.e. on a machine where no consumer applications or web browsers are installed, besides traffic that is to be expected (HTTP and SSH)

 PID USER     PROGRAM                                           DEV        SENT      RECEIVED       
5266 www-data /usr/sbin/apache2                                 eth0      15.142       2.924 KB/sec
4698 <ME>     sshd: <ME>@pts/0                                  eth0       0.899       0.071 KB/sec

I’m also seeing quite a few suspicious connections that look like this:

 PID USER     PROGRAM                                           DEV        SENT      RECEIVED       
   ? root     <SERVER_IP_V4>:515-122.228.XXX.XXX:43652                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:4946-92.118.XXX.XXX:44243                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:1703-94.177.XXX.XXX:51820                     0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:1433-123.207.XXX.XXX:45628                    0.000       0.000 KB/sec
   ? root     <SERVER_IP_V4>:34568-223.71.XXX.XXX:40922                    0.000       0.011 KB/sec
   ? root     <SERVER_IP_V4>:9444-51.91.XXX.XXX:46170                      0.000       0.000 KB/sec
   ? root     unknown TCP                                                  0.000       0.000 KB/sec

So they have no associated process ID [1], are all run by root, seem to be outgoing connections from random-looking ports to other random-looking ports (i.e. no outgoing HTTP requests [2] [3]), have no associated device, and all have little to no traffic [4].

The geographic origins of the destination addresses seem to be China, Russian Federation and Seychelles, among others, as per whois.

My firewall rules, as per ufw status verbose, should actually block any incoming traffic except for SSH and HTTP(S). So these outgoing connections would have to be caused by malicious programs running on the host, right?

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     LIMIT IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  

Is this indeed suspicious or perhaps even evidence of malicious traffic, or are these some false positives (for some reason I may not be seeing)?

Or is the order of the two IP addresses in each pair not relevant [5] [6], so that these might in fact be incoming connections? If so, how can this happen if UFW has been configured to block such connections, and how can one of these connections even have data transferred?

My problem is with snapd. When I connect my pc to my mobile hotspot, my pc downloads lots of data. I downloaded nethogs and I saw usr/lib/snapd/snapd downloads sometimes with mb/s. I thought this could be resolved with an update, but the "Software Updater" application doesn't help. I tried to disable "automatically check for updates" in 'Software & Updates' but that doesn't help either. I found sudo systemctl stop snapd.service command and after running it, /usr/lib/snapd/snapd is missing from nethogs (not downloading anything) but after ~1-2 min, it starts downloading again.

How can I stop that download?

I am on Ubuntu 18.04 LTS. Updated the system to the latest. Recently I noticed something unusual on Ubuntu with my Internet connection. My limited Internet quota was used up quickly by something invisible. As a user came from Windows this was something odd as Ubuntu never did such a thing to me. I installed nethogs and found out that the devil who vanished my data was /usr/lib/snapd/snapd

I found a somewhat similar question, but it does not answer what I am going to ask. Removing snapd from start up did not help either.

• Why does snapd use this much data?

• Is there a way to stop those connections without disabling snap apps?

  

I am running a network related program that performs TLS handshakes with many hosts. I ant to monitor the network traffic so I used nethogs. It shows 0 KB.

NetHogs version 0.8.5-2

PID USER     PROGRAM                    DEV        SENT      RECEIVED       
  ? root     unknown TCP                            0.000       0.000 KB/sec

  TOTAL                                                 0.000       0.000 KB/sec

I have previously run this program and nethogs was showing me information about the network traffic. What is the problem? How to see the ongoing/outgoing traffic? Are there alternative tools?

I use Ubuntu 18.04. The command I entered:

sudo nethogs

I also tried with the adapter name that I obtain using ifconfig:

sudo nethogs enx9cebe8b0d86a

It seems that if I have my tether on before booting, there is a strong upload from my system to the phone. However, it also seems that nothing is being uploaded from my phone to the internet.

How can I know what it is. I see something like nethogs, but I do not see anything really eating bandwidth. but I do not know how to give it an whatever that is...

I think it might be related to sending an error report, but it seems to never stop...many times.. 40 or 50 mb.. if I reboot sometimes.. it stops.. sometimes not. It does not happen all of the time, but I have narrowed it down to doing this upload thing if I have the tether on before booting. Then it does this uploading stuff. Here is a picture of nethogs NOT showing me who it is.

Please help quickly. I am in Myanmar and this can kill my $10 per month budget.

Is it at virus or something to do with a browser synching.. or something. I have chrome, moz, and opera. but they are not running as far as I can see. I just rebooted (twice) until it finally stopped. maybe it was finished uploading and phishing my emails or something.