Here are the netstat -tnp output captures from my Ubuntu 22.04 workstation. Why are there outbound NetworkManager connections established from time to time? What are they doing?
The IP addresses involved have a domain name of blackcat.canonical.com.
I am quite certain that I have never asked the NetworkManager on my workstation to initiate any outbound communication with blackcat.canonical.com. My firewall definitely blocks all inbound traffic from unknown sources. Is this some kind of statistic-gathering logic implanted in the Ubuntu NetworkManager?
open_ports_20240622_035533.log:tcp 0 1 192.168.0.107:55458 185.125.190.17:80 SYN_SENT 971/NetworkManager
open_ports_20240622_040033.log:tcp 0 87 192.168.0.107:52642 91.189.91.49:80 ESTABLISHED 971/NetworkManager
open_ports_20240622_040533.log:tcp 0 87 192.168.0.107:59904 185.125.190.98:80 ESTABLISHED 971/NetworkManager
open_ports_20240622_130532.log:tcp 0 1 192.168.0.107:51542 185.125.190.97:80 SYN_SENT 971/NetworkManager
open_ports_20240622_131033.log:tcp 0 87 192.168.0.107:53868 185.125.190.48:80 ESTABLISHED 971/NetworkManager
open_ports_20240622_224533.log:tcp 0 87 192.168.0.107:58776 185.125.190.48:80 ESTABLISHED 971/NetworkManager
The following is the bash script that I used to gather netstat output every thirty seconds. You are welcome to modify the "myusername" and try out.
#!/bin/bash
# Specify the user to write the log files
user="myname"
prev_ips_file="/tmp/prev_ips.txt"
if [ ! -f $prev_ips_file ]; then
touch $prev_ips_file
fi
while true; do
# Create a directory to store log files as the specified user
log_dir="logs_$(date +'%Y%m%d')"
sudo -u $user mkdir -p "$log_dir"
# Initialize a counter
count=0
# Loop to log netstat output every minute for 24 hours
while [ $count -lt 2880 ]; do
log_file="$log_dir/open_ports_$(date +'%Y%m%d_%H%M%S').log"
# Get current list of netstat entries and IP addresses
current_netstat=$(netstat -tnp)
current_ips=$(echo "$current_netstat" | awk '{print $5}' | cut -d: -f1 | sort | uniq)
# Save current IPs to a temporary file
echo "$current_ips" > /tmp/current_ips.txt
# Compare with previous IP addresses and log only new ones
comm -13 $prev_ips_file /tmp/current_ips.txt > /tmp/new_ips.txt
new_ips=$(cat /tmp/new_ips.txt)
if [ -s /tmp/new_ips.txt ]; then
while IFS= read -r ip; do
echo "$current_netstat" | grep -w "$ip" | sudo -u $user tee -a "$log_file" > /dev/null
done < /tmp/new_ips.txt
else
rm -f "$log_file"
fi
# Update the previous IPs file
mv /tmp/current_ips.txt $prev_ips_file
sleep 30
count=$((count + 1))
done
# Optionally, compress the log directory after 24 hours as the specified user
sudo -u $user tar -czf "$log_dir.tar.gz" "$log_dir"
sudo -u $user rm -r "$log_dir"
done