On Monday, November 30, 2020, 12:57:18 PM EST, home user <mattisonw@comcast.net> wrote:
Fedora-32 home workstation; gnome.
In ksysguard, I've been noticing internet activity that I can't explain. This has been going on for weeks, and it's making me uncomfortable.
What I do:
1. After the system has been powered down overnight, I boot it up.
2. I sign in to a user account.
3. My .bash_profile sources my .bashrc, sets PATH, and launches xeyes. My .bashrc sources /etc/bashrc, sets PS1 and PATH, and defines aliases.
4. I launch ksysguard, then Spectacle.
5. I wait several seconds, then take a screen-capture of ksysguard's display.
To get a good sample, I did five screen-captures. Here are the google drive links to them:
Notes:
* neither Thunderbird nor any other e-mail client nor Firefox nor any other browser had been launched since powering up.
* as far as I know, nothing else that uses the internet had been launched since powering up. actually, the only things I had running were xeyes, ksysguard, Spectacle, and (in the last screen-shot only) gnome terminal (which was idle).
* as far as I know, nothing is set to auto-update.
* as far as I know, nothing has telemetry permission enabled.
Yet there is persistent, continual (not continuous) internet activity in both directions. What is it? What on my system is communicating with what externally, and what is being communicated? Unauthorized updating? Unauthorized telemetry? Unauthorized distributed computing? Spyware? Crypto-currency mining?
This is way outside my knowledge and experience. I need good step-by-step instructions on this.
Thank-you in advance.
Bill.
_______________________________________________