0

I recently installed Xubuntu and I have noticed my new OS making some strange connections. I have made sure to close everything that would have a reason to make any connection like the music player(album art) or the software center. Alas, when I run the command: 

ss -tpras

It returns: 

State      Recv-Q Send-Q      Local Address:Port          Peer Address:Port   
LISTEN     0      5                  system:domain                   *:*       
LISTEN     0      128             localhost:ipp                      *:*       
CLOSE-WAIT 1      0            172.18.24.13:38304   backoo.canonical.com:http     users:(("gvfsd-http",4740,10))  
CLOSE-WAIT 1      0            172.18.24.13:38305   backoo.canonical.com:http     users:(("gvfsd-http",4740,14))  
CLOSE-WAIT 1      0            172.18.24.13:38303   backoo.canonical.com:http     users:(("gvfsd-http",4740,13))  
CLOSE-WAIT 1      0            172.18.24.13:38307   backoo.canonical.com:http     users:(("gvfsd-http",4740,16))  
CLOSE-WAIT 1      0            172.18.24.13:38306   backoo.canonical.com:http     users:(("gvfsd-http",4740,15))  
CLOSE-WAIT 1      0            172.18.24.13:38247   backoo.canonical.com:http     users:(("gvfsd-http",4740,12))  
LISTEN     0      128         ip6-localhost:ipp                     :::*

I can not seem to figure out why these connections are even being made. I find that others are having the same issue, yet I have not found a case where "gvfsd-http" connects to, and leaves an open connection to "backoo.canonical.com". I have found articles like this one:

https://askubuntu.com/questions/112318/strange-connections-by-gvfsd-http-spawner

yet it always seems to be connecting to somewhere else. So I am left with the question: Exactly what is this, and exactly why is it making connections to this server? I'm kind of paranoid person and things like this are not really helping :/

Has anybody else found this happening to them?

ps:Xubuntu 14.04 fresh install

Community
  • 1
user 82735
  • 3

1 Answers1

0

This is a long-standing bug in the Gnome Virtual Filesystem Daemon (gvfsd), see here: https://bugs.launchpad.net/ubuntu/+source/libsoup/+bug/760344 Basically gvfsd does not properly clean up connections in CLOSE_WAIT state. A connection in CLOSE_WAIT state is a connection that has been closed by both peers and the local system is waiting for the local client to release the socket. gvfsd is not doing that, therefore you see old closed connections in CLOSED_WAIT state.

Why those connections have been opened in the first place is another question. Common local applications opening connections through gvfsd are Zeitgeist, Softwarecenter and Rhythmbox. But you can also cause gvfsd-http connections by dragging & dropping objects from a webbrowser into your local filesystem. The somewhat spotty documentation https://wiki.gnome.org/Projects/gvfs/doc unfortunately only hints at what's happening here.

If you want to know, which packages depend on gvfsd run

apt-cache --installed rdepends libsoup

From there you can decide, which of those you really want to keep.

bjanssen
  • 2,529