Re: mysterious/suspicious internet activity. [solved] [REALLY SOLVED]

2020-12-15 Thread home user
After a weekly patching and several boots, what Ed suggested continues to work.  This includes e-mail, browser, dnf upgrade, dnf install, zoom, and video downloads (via Firefox add-on and via command line).  As best as I can see, nothing got broke and everything works as it should.  So I'm tagg

Re: mysterious/suspicious internet activity.

2020-12-10 Thread George N. White III
Privacy Extensions for Stateless Address Autoconfiguration in IPv6 On Mon, 7 Dec 2020 at 05:18, Ed Greshko wrote: > On 07/12/2020 11:11, Tim via users wrote: > > On Sun, 2020-12-06 at 15:43 -0400, George N. White III wrote: > >> As more systems use IPv6, bad actors will have to collect > >> acti

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Joe Zeff
On 12/7/20 4:50 PM, Patrick O'Callaghan wrote: Man of La Mancha is a musical based on Don Quixote. I wouldn't regard it as the same thing, but it's a matter of opinion. Neither do I, but at least you can get an idea of what the story's about by watching it. ___

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Patrick O'Callaghan
On Mon, 2020-12-07 at 12:41 -0700, Joe Zeff wrote: > On 12/7/20 4:45 AM, Patrick O'Callaghan wrote: > > On Sun, 2020-12-06 at 22:06 -0700, home user wrote: > > > Is Don Quixote available as an English-language movie? > > Not really. There are several Spanish versions (see IMDB) but the book > > is

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Joe Zeff
On 12/7/20 4:45 AM, Patrick O'Callaghan wrote: On Sun, 2020-12-06 at 22:06 -0700, home user wrote: Is Don Quixote available as an English-language movie? Not really. There are several Spanish versions (see IMDB) but the book is so expansive that it's hard to imagine a successful movie adaptatio

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Patrick O'Callaghan
On Mon, 2020-12-07 at 14:08 +0200, Iosif Fettich wrote: > although this is as off-topic already as it could be, without being marked as > such in the subject. Go for > > https://en.wikipedia.org/wiki/Man_of_La_Mancha_(film) > > See the film, if you can find it. You won't regret. I know of at le

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Iosif Fettich
Hi there, although this is as off-topic already as it could be, without being marked as such in the subject. Go for https://en.wikipedia.org/wiki/Man_of_La_Mancha_(film) See the film, if you can find it. You won't regret. Best regards, Iosif Fettich On Mon, 7 Dec 2020, Patrick O'Callaghan

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Patrick O'Callaghan
On Sun, 2020-12-06 at 22:06 -0700, home user wrote: > Is Don Quixote available as an English-language movie? Not really. There are several Spanish versions (see IMDB) but the book is so expansive that it's hard to imagine a successful movie adaptation. It would probably have to be a mini-series at

Re: mysterious/suspicious internet activity.

2020-12-07 Thread Ed Greshko
On 07/12/2020 11:11, Tim via users wrote: On Sun, 2020-12-06 at 15:43 -0400, George N. White III wrote: As more systems use IPv6, bad actors will have to collect active IPv6 addresses. You may be one of the first to see that start. I have to wonder how that's going to go. With IPv4 most peop

Re: mysterious/suspicious internet activity. [solved]

2020-12-07 Thread Ed Greshko
On 07/12/2020 13:06, home user wrote:  I'm going back to thinking of a firewall as that part of my ol' jalopy that separates me (in the driver's seat) from the engine compartment!  :) Well, that is the origin of the term. (Don Quixote) Is Don Quixote available as an English-language movie?

Re: mysterious/suspicious internet activity. [solved]

2020-12-06 Thread home user
On 12/5/20 11:20 PM, Ed Greshko wrote: If you want to make your system "invisible" and won't be running any services you should simply change the zone of your internet interface from "public" to "drop". firewall-cmd --permanent --zone=drop --change-interface=eno1 firewall-cmd --reload -bash.

Re: mysterious/suspicious internet activity.

2020-12-06 Thread Tim via users
On Sun, 2020-12-06 at 15:43 -0400, George N. White III wrote: > As more systems use IPv6, bad actors will have to collect > active IPv6 addresses. You may be one of the first to see that > start. I have to wonder how that's going to go. With IPv4 most people were behind NAT (which isn't a fire

Re: mysterious/suspicious internet activity.

2020-12-06 Thread Ed Greshko
On 07/12/2020 03:43, George N. White III wrote: On Thu, 3 Dec 2020 at 06:00, Ed Greshko mailto:ed.gres...@greshko.com>> wrote: [...]  I can't think of anyone that would go through the trouble of unpacking pcap output to find IP addresses they could attack.  They either farm IP addre

Re: mysterious/suspicious internet activity.

2020-12-06 Thread Ed Greshko
On 07/12/2020 03:43, George N. White III wrote: On Thu, 3 Dec 2020 at 06:00, Ed Greshko mailto:ed.gres...@greshko.com>> wrote: [...]  I can't think of anyone that would go through the trouble of unpacking pcap output to find IP addresses they could attack.  They either farm IP addre

Re: mysterious/suspicious internet activity.

2020-12-06 Thread George N. White III
On Thu, 3 Dec 2020 at 06:00, Ed Greshko wrote: > [...] I can't think of anyone that would go through the > trouble of unpacking pcap output to find IP addresses they could attack. > They either > farm IP addresses from emails, dns queries, or just plain find blocks of > IP addresses > to attack.

Re: mysterious/suspicious internet activity.

2020-12-06 Thread Patrick O'Callaghan
On Sat, 2020-12-05 at 15:46 -0800, Samuel Sieb wrote: > On 12/5/20 2:53 PM, home user wrote: > > On 12/4/20 10:45 PM, Ed Greshko wrote: > > > I pretty much think this topic has been totally addressed and feel > > > there really is no need to go about > > > tilting at windmills. > > > > Strange ex

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread Ed Greshko
On 06/12/2020 12:49, home user wrote: On 12/5/20 9:24 PM, Samuel Sieb wrote: and the outgoing is the firewall's rejections I'm no expert, but I believe the firewall can be set to utterly ignore things it blocks rather than sending a rejection. Generally this is more useful for things connecte

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread Tim via users
On Sat, 2020-12-05 at 21:43 -0500, Tom Horsley wrote: > I'm no expert, but I believe the firewall can be set to utterly > ignore things it blocks rather than sending a rejection. Generally > this is more useful for things connected to the internet at large > since you'll just get random probes rath

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread home user
On 12/5/20 9:24 PM, Samuel Sieb wrote: and the outgoing is the firewall's rejections I'm no expert, but I believe the firewall can be set to utterly ignore things it blocks rather than sending a rejection. Generally this is more useful for things connected to the internet at large since you'll

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread Samuel Sieb
On 12/5/20 6:43 PM, Tom Horsley wrote: On Sat, 5 Dec 2020 19:28:15 -0700 home user wrote: and the outgoing is the firewall's rejections I'm no expert, but I believe the firewall can be set to utterly ignore things it blocks rather than sending a rejection. Generally this is more useful for th

Re: mysterious/suspicious internet activity.

2020-12-05 Thread Joe Zeff
On 12/5/20 4:46 PM, Samuel Sieb wrote: Google would have told you right away: Don Quixote I haven't read the book, but I'm aware of the expression.  Now I'm curious and will have to ask around to see how generally well-known it is It's still well-known 400 years after it was published. __

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread home user
On 12/5/20 7:43 PM, Tom Horsley wrote: On Sat, 5 Dec 2020 19:28:15 -0700 home user wrote: and the outgoing is the firewall's rejections I'm no expert, but I believe the firewall can be set to utterly ignore things it blocks rather than sending a rejection. Generally this is more useful for th

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread Tom Horsley
On Sat, 5 Dec 2020 19:28:15 -0700 home user wrote: > and the outgoing is the firewall's rejections I'm no expert, but I believe the firewall can be set to utterly ignore things it blocks rather than sending a rejection. Generally this is more useful for things connected to the internet at large s

Re: mysterious/suspicious internet activity. [solved]

2020-12-05 Thread home user
(part 1) After the experience of this thread, a tool I'd like to see is something like netstat or ss or the network activity (bottom panel) of the ksysguard, except it would show: * incoming traffic after firewall screening but before the "passed" traffic reaches the rest of the system, and *

Re: mysterious/suspicious internet activity.

2020-12-05 Thread Samuel Sieb
On 12/5/20 2:53 PM, home user wrote: On 12/4/20 10:45 PM, Ed Greshko wrote: I pretty much think this topic has been totally addressed and feel there really is no need to go about tilting at windmills. Strange expression.  Haven't heard it before.  I'll have to ask those Dutch organists that

Re: mysterious/suspicious internet activity.

2020-12-05 Thread Ed Greshko
On 06/12/2020 06:53, home user wrote: The first part was intended to be taken somewhat humorously. Yes, as was my reply It wouldn't be a fair contest since Samuel is one time zone away and you're 15 time zones away (if I remember correctly, and neither of you has moved).  :) But, wit

Re: mysterious/suspicious internet activity.

2020-12-05 Thread home user
On 12/4/20 10:45 PM, Ed Greshko wrote: [... snip ...] So, you can just sudo systemctl --now disable libvirtd Without the "--now" you'd have to reboot for this to take effect. hmmm...  Samuel beat you to it.  I'll very soon be shutting down for the night anyway. I was unaware of bei

Re: mysterious/suspicious internet activity.

2020-12-04 Thread Ed Greshko
On 05/12/2020 12:34, home user wrote: On 12/4/20 9:08 PM, Ed Greshko wrote: I've never heard of this.  I'm not sure, but this seems like something I don't use, at least not explicitly.  Is this something that I can remove from the system, or at least turn off (so it won't use CPU),  Or is thi

Re: mysterious/suspicious internet activity.

2020-12-04 Thread home user
On 12/4/20 9:08 PM, Ed Greshko wrote: I've never heard of this.  I'm not sure, but this seems like something I don't use, at least not explicitly.  Is this something that I can remove from the system, or at least turn off (so it won't use CPU), Or is this "under the hood" of things I do use?

Re: mysterious/suspicious internet activity.

2020-12-04 Thread home user
On 12/4/20 8:53 PM, Samuel Sieb wrote: I've never heard of this.  I'm not sure, but this seems like something I don't use, at least not explicitly.  Is this something that I can remove from the system, or at least turn off (so it won't use CPU), Or is this "under the hood" of things I do use?

Re: mysterious/suspicious internet activity.

2020-12-04 Thread Ed Greshko
On 05/12/2020 11:44, home user wrote: On 12/3/20 10:57 PM, Ed Greshko wrote: The virbr0 interface is the interface between your system and any qemu/kvm Virtual Machines you deploy.  This is an "internal" interface not connected directly to the Internet. I've never heard of this.  I'm not sur

Re: mysterious/suspicious internet activity.

2020-12-04 Thread Samuel Sieb
On 12/4/20 7:44 PM, home user wrote: On 12/3/20 10:57 PM, Ed Greshko wrote: The virbr0 interface is the interface between your system and any qemu/kvm Virtual Machines you deploy.  This is an "internal" interface not connected directly to the Internet. I've never heard of this.  I'm not sure

Re: mysterious/suspicious internet activity.

2020-12-04 Thread home user
On 12/3/20 10:57 PM, Ed Greshko wrote: The virbr0 interface is the interface between your system and any qemu/kvm Virtual Machines you deploy.  This is an "internal" interface not connected directly to the Internet. I've never heard of this. I'm not sure, but this seems like something I don

Re: mysterious/suspicious internet activity.

2020-12-04 Thread home user
On 12/2/20 2:11 PM, Barry Scott wrote: 3. My .bash_profile sources my .bashrc, sets PATH, and launches xeyes.  My .bashrc sources /etc/bashrc, sets PS1 and PATH, and defines aliases. Set PATH in your .bash_profile not .bashrc. This is because if you set it in .bashrc you cannot override PATH

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 04/12/2020 12:59, home user wrote: On 12/3/20 8:10 PM, Ed Greshko wrote: I believe the firewall on your system is already dropping all incoming connection requests. Provide the output of sudo firewall-cmd --get-active-zones and then using the result from that command sudo firewall-c

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/3/20 8:10 PM, Ed Greshko wrote: I believe the firewall on your system is already dropping all incoming connection requests. Provide the output of sudo firewall-cmd --get-active-zones and then using the result from that command sudo firewall-cmd --info-zone=whatever-was returned.

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
This afternoon, I did some more experimenting.  As at first, I booted up.  I then logged in, but this time as root.  I did *not* launch Thunderbird (or any other e-mail client) or Firefox (or any other browser) or anything else that I know uses the internet.  So the workstation should be "quiet

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 5:51 PM, home user wrote: On 12/3/20 6:35 PM, Samuel Sieb wrote: On 12/3/20 5:28 PM, home user wrote: On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark. 

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 04/12/2020 10:51, home user wrote: J. Witvliet responded to my original post, but his response showed up in the list as a new thread. I'm responding here. (on Dec. 01, 2020 at 02:35am US mountain time, J. Witvliet wrote) What puzzles me, is that you don’t refer to the firewall. It’s the fi

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
J. Witvliet responded to my original post, but his response showed up in the list as a new thread. I'm responding here. (on Dec. 01, 2020 at 02:35am US mountain time, J. Witvliet wrote) > What puzzles me, is that you don’t refer to the firewall. > It’s the firewall responsibility to block unexpe

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 5:34 PM, home user wrote: On 12/2/20 9:11 PM, Ed Greshko wrote: I think this would be easier for you to capture network traffic at this time.. With a quite system, open a terminal and as root use the following to capture some packets tcpdump -c 500 port 22 -w cap.pcap T

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/3/20 6:35 PM, Samuel Sieb wrote: On 12/3/20 5:28 PM, home user wrote: On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark.  There should be a list of interfaces.

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 5:28 PM, home user wrote: On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark.  There should be a list of interfaces.  Double click on your ethernet one. W

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/2/20 9:11 PM, Ed Greshko wrote: I think this would be easier for you to capture network traffic at this time.. With a quite system, open a terminal and as root use the following to capture some packets tcpdump -c 500 port 22 -w cap.pcap This will capture 500 packets and then

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
On 12/3/20 5:31 PM, Samuel Sieb wrote: You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in.  Run wireshark.  There should be a list of interfaces.  Double click on your ethernet one. When I "opened" the cap.pcap that Ed se

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 11/30/20 3:47 PM, home user wrote: I've installed wireshark.  The man page is thousands of lines long.  Is there a good beginner-level tutorial for that?! You will need to add your user to the "wireshark" group: sudo usermod -a -G wireshark username Then logout and log back in. Run wireshar

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 2:01 PM, Ed Greshko wrote: On 04/12/2020 05:04, Samuel Sieb wrote: Is your computer's IP address in the 192.168.* or 10.* ranges?  If not, then you're directly connected.  Since you mentioned seeing login attempts before, you most likely are. You forgot the less common 172.16.0.0

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 4:01 PM, home user wrote: In gnome, I click the little network? symbol in the upper right corner of the display, just left of the speaker symbol. In the little box that comes up, from top to bottom, there is * "Wired Settings". I pick "Wired Settings". Here are the results: "https:

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
In gnome, I click the little network? symbol in the upper right corner of the display, just left of the speaker symbol. In the little box that comes up, from top to bottom, there is * a volume slider, * "Wired Connected >", * "Settings >", and * "Power Off / Log Out >". I click the "Wired Connec

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
> On 2020-12-03 19:40, home user wrote: > > > Yellow? Is that safe? (Joke.) I could use a good laugh these days. I 'm missing the joke. Please explain it. > Sometimes what users think is just a "modem" also contains a small > router > and enough of a firewall to do NAT. Sometimes (as with

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Jeremy Nicoll - ml fedora
On 2020-12-03 19:40, home user wrote: I was asked about this system. * comcast(my ISP) connected via metal wire cable to Arris phone modem connected via ethernet cable (yellow) to the workstation tower port. Yellow? Is that safe? (Joke.) Sometimes what users think is just a "modem" also con

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 04/12/2020 05:04, Samuel Sieb wrote: Is your computer's IP address in the 192.168.* or 10.* ranges?  If not, then you're directly connected.  Since you mentioned seeing login attempts before, you most likely are. You forgot the less common 172.16.0.0 – 172.31.255.255 range. --- The key to g

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 11:40 AM, home user wrote: I did not fully understand them, but I got the sense that I should get help and not try to tackle this on my own. Finding and removing cryptominers can be very difficult. It's also extremely unlikely that you have something like that. I was asked about

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Samuel Sieb
On 12/3/20 1:11 AM, Tim via users wrote: Tim: All normal stuff, although they're listening to any address, rather than only listening to local addresses. That could be tightened up for some things, at least. I see no reason for CUPS to listen outside of your LAN, for instance. Samuel Sieb:

Re: mysterious/suspicious internet activity.

2020-12-03 Thread home user
My posts to this list were apparently not reaching the list for a couple of days. This was fedora infrastructure issue 9509. It's fixed. Since the fix, I've been buried in personal business. I now have some time to get back to this problem. Prior to opening this thread, I did try digging in

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 03/12/2020 12:16, Samuel Sieb wrote: Also, the capture file could contain some information that shouldn't be publicly shared. OK  Let me try to make it "easier" for the OP to use this particular "process of elimination". Meaning, eliminate brute force ssh attacks as the source of "myst

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 03/12/2020 12:16, Samuel Sieb wrote: Also, the capture file could contain some information that shouldn't be publicly shared. OK  Let me try to make it "easier" for the OP to use this particular "process of elimination". Meaning, eliminate brute force ssh attacks as the source of "myst

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Ed Greshko
On 03/12/2020 17:14, Tim via users wrote: On Thu, 2020-12-03 at 12:53 +0800, Ed Greshko wrote: I suppose if one is paranoid about posting their ip addresses they may be concerned. I tend to avoid that, because it just invites some people to have a go. However, in most posts to a mailing list yo

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Tim via users
On Thu, 2020-12-03 at 12:53 +0800, Ed Greshko wrote: > I suppose if one is paranoid about posting their ip addresses they > may be concerned. I tend to avoid that, because it just invites some people to have a go. However, in most posts to a mailing list your IP is in the mail headers. I remember

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Tim via users
Tim: >> All normal stuff, although they're listening to any address, rather >> than only listening to local addresses. That could be tightened up >> for some things, at least. I see no reason for CUPS to listen >> outside of your LAN, for instance. Samuel Sieb: > I assume you're referring to the

Re: mysterious/suspicious internet activity.

2020-12-03 Thread Tim via users
On Thu, 2020-12-03 at 08:59 +0800, Ed Greshko wrote: > [egreshko@meimei etc]$ host no-mans-land.m247.com > Host no-mans-land.m247.com not found: 3(NXDOMAIN) > > So, what is the real IP address of that hostname? m247.com comes up with a general cloud service website, perhaps the no- mans-land pref

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Ed Greshko
On 03/12/2020 12:16, Samuel Sieb wrote: On 12/2/20 8:11 PM, Ed Greshko wrote: On 03/12/2020 00:09, home user wrote: (I sent this to the list three times in the past two days; it apparently never arrived, and it did not bounce.) I rebooted, and did a few netstat's and an iftop while the workst

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Samuel Sieb
On 12/2/20 8:11 PM, Ed Greshko wrote: On 03/12/2020 00:09, home user wrote: (I sent this to the list three times in the past two days; it apparently never arrived, and it did not bounce.) I rebooted, and did a few netstat's and an iftop while the workstation was "quiet".  I pasted output from

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Ed Greshko
On 03/12/2020 00:09, home user wrote: (I sent this to the list three times in the past two days; it apparently never arrived, and it did not bounce.) I rebooted, and did a few netstat's and an iftop while the workstation was "quiet". I pasted output from 2 netstat runs into a text file. I t

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Ed Greshko
On 03/12/2020 00:02, home user wrote: (I sent this to the list three times in the past two days; it apparently never arrived, and it did not bounce.) I rebooted, and did a few netstat's and an iftop while the workstation was "quiet".  I pasted output from 2 netstat runs into a text file. I pa

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Samuel Sieb
On 12/2/20 3:06 PM, Tim via users wrote: All normal stuff, although they're listening to any address, rather than only listening to local addresses. That could be tightened up for some things, at least. I see no reason for CUPS to listen outside of your LAN, for instance. I assume you're refe

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Tim via users
On Wed, 2020-12-02 at 16:09 +, home user wrote: > --- begin text file --- > Active Internet connections (servers and established) > Proto Recv-Q Send-Q Local Address Foreign Address State > User Inode PID/Program name > tcp0

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Barry Scott
> On 30 Nov 2020, at 21:03, Ed Greshko wrote: > > On 01/12/2020 04:57, home user wrote: >> How do I check that? And how do I change it? By the way, I power down >> every night; and power up every morning. > > Along with watching the output of wireshark, you should run "netstat -atuevp" > a

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Barry Scott
> On 30 Nov 2020, at 17:57, home user wrote: > > 3. My .bash_profile sources my .bashrc, sets PATH, and launches xeyes. My > .bashrc sources /etc/bashrc, sets PS1 and PATH, and defines aliases. Set PATH in your .bash_profile not .bashrc. This is because if you set it in .bashrc you cannot o

Re: mysterious/suspicious internet activity.

2020-12-02 Thread stan via users
A non expert response. On Wed, 02 Dec 2020 16:09:16 - "home user" wrote: > A few years ago, I saw in the system journal numerous log-in attempts > by outsiders from all over the world, and opened a thread about that. > Now such attempts are blocked by the firewall. If an outsider tries > t

Re: mysterious/suspicious internet activity.

2020-12-02 Thread home user
(I sent this to the list three times in the past two days; it apparently never arrived, and it did not bounce.) I rebooted, and did a few netstat's and an iftop while the workstation was "quiet". I pasted output from 2 netstat runs into a text file. I paused the iftop display many times to gra

Re: mysterious/suspicious internet activity.

2020-12-02 Thread home user
(I sent this to the list three times in the past two days; it apparently never arrived, and it did not bounce.) I rebooted, and did a few netstat's and an iftop while the workstation was "quiet".  I pasted output from 2 netstat runs into a text file. I paused the iftop display many times to g

Re: mysterious/suspicious internet activity.

2020-12-02 Thread Ralf Corsepius
On 12/1/20 1:18 AM, home user wrote: (on Mon, 2020-11-30 at 23:56 +, Ed wrote) > I thought you said your system was "quiet"? > > For your "network activity" issue the lines of interest are those > which include "ESTABLISHED" as the state. > > It shows both "thunderbird" and "firefox" ar

Re: mysterious/suspicious internet activity.

2020-12-01 Thread J.Witvliet--- via users
From: "home user" mailto:mattis...@comcast.net>> Date: Monday, 30 November 2020 at 18:57:40 To: "users@lists.fedoraproject.org" mailto:users@lists.fedoraproject.org>> Subject: mysterious/suspicious internet activity. Fedora-32 home workstation; gnome.

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Ed Greshko
On 01/12/2020 08:18, home user wrote: (on Mon, 2020-11-30 at 23:56 +, Ed wrote) > I thought you said your system was "quiet"? > > For your "network activity" issue the lines of interest are those > which include "ESTABLISHED" as the state. > > It shows both "thunderbird" and "firefox" are bot

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Ed Greshko
On 01/12/2020 08:18, home user wrote: (on Mon, 2020-11-30 at 23:56 +, Ed wrote) > I thought you said your system was "quiet"? > > For your "network activity" issue the lines of interest are those > which include "ESTABLISHED" as the state. > > It shows both "thunderbird" and "firefox" are bot

Re: mysterious/suspicious internet activity.

2020-11-30 Thread home user
(on Mon, 2020-11-30 at 23:56 +, Ed wrote) > I thought you said your system was "quiet"? > > For your "network activity" issue the lines of interest are those > which include "ESTABLISHED" as the state. > > It shows both "thunderbird" and "firefox" are both running and connected > to hosts.  So

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Ed Greshko
On 01/12/2020 07:47, home user wrote: (on Mon, 2020-11-30 at 18:37 +, Tim wrote) > ...you really want to do something like "netstat -atuevp" to see what, where, > and who is involved in network traffic. (on Mon, 2020-11-30 at 21:03 +, Ed Greshko wrote) > Along with watching the output of

Re: mysterious/suspicious internet activity.

2020-11-30 Thread home user
(on Mon, 2020-11-30 at 18:37 +, jtj wrote) >AKAIK, Fedora checks for updates at intervals to notify them > via dnfdragora. May be that. (I replied to this hours ago, but I don't see my reply in the thread.  Trying again.) A few years ago, with the help of members of this list, I turned off

Re: mysterious/suspicious internet activity.

2020-11-30 Thread home user
(on Mon, 2020-11-30 at 18:37 +, Tim wrote) > ...you really want to do something like "netstat -atuevp" to see what, where, > and who is involved in network traffic. (on Mon, 2020-11-30 at 21:03 +, Ed Greshko wrote) > Along with watching the output of wireshark, you should run "netstat

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Ed Greshko
On 01/12/2020 04:57, home user wrote: How do I check that? And how do I change it? By the way, I power down every night; and power up every morning. Along with watching the output of wireshark, you should run "netstat -atuevp" and see what connections are "established". --- The key to gett

Re: mysterious/suspicious internet activity.

2020-11-30 Thread stan via users
On Mon, 30 Nov 2020 20:57:13 - "home user" wrote: > So how do I get network traffic data for a full minute? That seems > like the best option to either establish that something bad is going > on, or that Joe Wulf is correct. You can observe your network connections by running iftop as root.

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Samuel Sieb
On 11/30/20 12:57 PM, home user wrote: So how do I get network traffic data for a full minute? That seems like the best option to either establish that something bad is going on, or that Joe Wulf is correct. Install wireshark. That will let you monitor all the traffic and see what's happen

Re: mysterious/suspicious internet activity.

2020-11-30 Thread home user
> On Mon, 2020-11-30 at 17:57 +, home user wrote: > > Only one of your image links loaded for me, the browser just spent ages > with the spinning circle. This one worked: > > https://drive.google.com/file/d/1AyZDRvcKYHYypNSU6AF9Fh34rh_l3q2J/view > Ah-ha! So that's it. The villain is googl

Re: mysterious/suspicious internet activity.

2020-11-30 Thread home user
> The pictures you shared look to me like very low amounts of data (2-6 > kilobytes).This is > going to be the standard networking which goes on with linux all the > time.System and > network-based services are reaching out to the router (gateway)periodically > to verify > connectivity and the

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Tim via users
On Mon, 2020-11-30 at 17:57 +, home user wrote: > In ksysguard, I've been noticing internet activity that I can't > explain. This has been going on for weeks, and it's making me > uncomfortable. Only one of your image links loaded for me, the browser just spent ages with the spinning circle.

Re: mysterious/suspicious internet activity.

2020-11-30 Thread jtj
El 30/11/20 a las 18:57, home user escribió: Fedora-32 home workstation; gnome. In ksysguard, I've been noticing internet activity that I can't explain. This has been going on for weeks, and it's making me uncomfortable. What I do: 1. After the system has been powered down overnight, I boot i

Re: mysterious/suspicious internet activity.

2020-11-30 Thread Joe Wulf via users
Bill, The pictures you shared look to me like very low amounts of data (2-6 kilobytes).This is going to be the standard networking which goes on with linux all the time.System and network-based services are reaching out to the router (gateway)periodically to verify connectivity and the like. I

mysterious/suspicious internet activity.

2020-11-30 Thread home user
Fedora-32 home workstation; gnome. In ksysguard, I've been noticing internet activity that I can't explain. This has been going on for weeks, and it's making me uncomfortable. What I do: 1. After the system has been powered down overnight, I boot it up. 2. I sign in to a user account. 3. My .ba