1

When I run iftop -P to see what is coming to/from my interface, I constantly see connections to Amazon, HTTPS protocol:

=> ec2-176-34-135-167.eu-west-1.compute.amazonaws.com:https <= => ec2-52-22-162-249.compute-1.amazonaws.com:https <= ...

Those connections reappear when I close and open my browser (Iceweasel, Debian testing). I cleared the cache and cookies but this is somehow persistent. I also disabled Amazon as a search engine. I do not own a cloud storage, neither a virtual machine on AWS.

How to trace the source of those connections?

Best Regards,
Kamil

EDIT

Output of lsof -i -nP, as requested by @thrig

iceweasel 8596 user 38u IPv4 90162 0t0 TCP 192.168.0.15:49156->216.58.209.78:443 (ESTABLISHED) iceweasel 8596 user 47u IPv4 90186 0t0 TCP 192.168.0.15:51544->52.25.142.225:443 (ESTABLISHED) iceweasel 8596 user 53u IPv4 86275 0t0 TCP 192.168.0.15:42090->52.32.59.229:443 (ESTABLISHED) iceweasel 8596 user 55u IPv4 90184 0t0 TCP 192.168.0.15:50570->52.11.148.42:443 (ESTABLISHED) iceweasel 8596 user 56u IPv4 87223 0t0 TCP 192.168.0.15:44370->54.187.136.191:443 (ESTABLISHED)

Hmm, there is Google too, maybe those are search engines updates?
NO. I disabled search engines autoupdates and restarted the browser. I also disabled Firefox (Iceweasel) Sync service, didn't help (I thought that maybe they store my data in Amazon cloud).

Improve this question
2
  • What does lsof -i -nP show as open? Commented Dec 23, 2015 at 22:42
  • Hmmm, lsof (after Iceweasel close/open) says it is iceweasel process. Please, see EDIT section in the original post. Commented Dec 23, 2015 at 22:49

1 Answer 1

Reset to default
1

Firefox periodically connects to distribution servers update some internal databases. There's at least:

I don't know where these services are hosted but given that Amazon is (one of?) the largest web hosting providers I wouldn't be surprised if they hosted some or all sources of automatic updates.

If you visit about:config and search for https://, you'll see a list of sites that Firefox might connect to. This includes sites that it automatically connects to as well as sites that it only connects to on some explicit user action (e.g. to browse extensions, access online help, etc.). Some plugins and extensions also have preferences listed there.

Generally, apart from update availability checking for Iceweasel (which should be disabled since the updates will be coming from Debian), what Firefox itself downloads automatically are desirable things, and you should only disable them if you have a good reason (e.g. a pay-per-minute connection that goes up automatically). I can't speak for whatever plugins or extensions might do by default.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.