Why is Kubuntu “phoning home”? Mysterious network activity!

[viking_maniac]

I installed the Gnome system monitor into Kubuntu since I think it's much greater than the one that comes with Kubuntu. Not long after, I suddenly discovered a lot of “bumps” in the network activity towards Internet at the network activity graph in Gnome system monitor. When my computer communicates pretty active with “something” on the Internet without me or any applications are doing anything, like when the OS is completely idle, and even when automatic updates and notifications are turned off, it sure raises some red flags in my security book!

So out of high curiosity, I installed Wireshark to see what is going trough my network.

To my huge surprise, after an hour or so and Kubuntu standing completely idle, a couple of megabytes have been transmitted:

A lot of requests have been sent from my local IP to: 224.0.0.251 port 5353 protocol MDNS. Though, no replies back, only from my IP to the IP mentioned.
Another thing that worried me was that my computer suddenly sent, out of the blue, a DNS request and started communicating with this address: 91.189.90.132 TCP/HTTP port 80. This address belongs to Canonical Ltd Admin, and Wireshark states this: Standard query, changelogs.ubuntu.com.

So my network card is suddenly pretty active after I got Kubuntu 9.10 and a lot of things going on (behind my back, apparently) which I actually don't like. As been written, I've disabled automatic updates and checks for updates, even notifications of updates. My computer is idle and this test was done right after login; I just left it idle with nothing happening on it. Well, something is happening!

I'm really curious about what this is and if this can be disabled. When I had Ubuntu 9.04, this didn't happen and my network card was totally quiet unless I started browsing or doing stuff on the net. Therefore I hope someone can share some light on this issue!

Thanks in advance!

[claydoh]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

it is [url=http://en.wikipedia.org/wiki/Avahi_(software)]avahi (also known as zeroconf or bonjour) . From the link:

t allows programs to publish and discover services and hosts running on a local network with no specific configuration. For example, you can plug into a network and Avahi instantly finds printers to print to, files to look at and people to talk to, as well as advertising the network services running on your machine.

Do remember this is going out to your local network, even if you only have one computer on it. Ahavi has been present on Ubuntu/Kubuntu and linux in general for some years now, though I don't know why it is just raising its head for you now. Perhaps it is checking for things way too often? If so, maybe a bug report is a good move for you to make.

I don't see a simple way to disable it right off the bat, but it should be fairly easy to find out. I am sure it could be uninstalled as well

[viking_maniac]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

This problem is so solved!

For those of you who are interested:

AVAHI-DAEMON
This is the sinner regarding outgoing MDNS-spam!
In terminal:
$ kdesudo kate /etc/avahi/avahi-daemon.conf
Edit:
deny-interfaces=<your network device> (of course without <>)

AVAHI-DAEMON
This is for disabling an idiotic DNS request at startup; only spamming the DNS-servers!
In terminal:
kdesudo kate /usr/lib/avahi/avahi-daemon-check-dns.sh
Edit:
AVAHI_DAEMON_DETECT_LOCAL=0

NTP (INTERNET AUTOMATIC TIME ADJUSTMENT/SYNC AT BOOT)
This happens at every boot, but can be disabled!
In terminal:
kdesudo kate /etc/default/ntpdate
Edit:
## NTPDATE_USE_NTP_CONF=yes
## NTPSERVERS="ntp.ubuntu.com"
## NTPOPTIONS=""
(Add ## to see which you edited in case you want to revert later.)

Make a copy of this guide in case you want to revert later. Nothing permanent is done here since you're not uninstalling anything, hence it's easy to revert.

After I did this, my network was completely quiet and didn't do anything over an idle period of several hours.

[kubicle]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

Leaving ntp on is usually a good idea, though, as computer clocks are known to be something "that are almost, but not completely unlike clocks"...of course you can change the server to another public ntp-server if you don't want to connect to the ubuntu one.

Avahi can be disabled, if you don't need it.

[Telengard]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

After I did this, my network was completely quiet and didn't do anything over an idle period of several hours.

While it is good to know you can disable those, they mostly seem pretty benign to me. In fact, I like having my clock synchronized with one that is more accurate.

If I really wanted to pick through every bit of the system, why not just build my own Linux? Isn't it easier to simply let the Kubuntu team choose some sensible defaults for me.

[viking_maniac]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

Leaving ntp on is usually a good idea, though, as computer clocks are known to be something "that are almost, but not completely unlike clocks"...of course you can change the server to another public ntp-server if you don't want to connect to the ubuntu one.

Avahi can be disabled, if you don't need it.

I don't have anything against connecting to the Ubuntu servers, but as you say, it might be a good idea having the clock synchronized.

But the constant network spamming from Avahi, I can live without. Do you know how to turn it completely off so it doesn't start during startup anymore?

[viking_maniac]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

While it is good to know you can disable those, they mostly seem pretty benign to me. In fact, I like having my clock synchronized with one that is more accurate.

If I really wanted to pick through every bit of the system, why not just build my own Linux? Isn't it easier to simply let the Kubuntu team choose some sensible defaults for me.

Well, I could never have done this on Windows 7 if I had these problems there. I guess this is what I like about Linux, you can start searching deep inside your system and eventually do whatever you want to.

I might turn on the clock sync again though.

[GreyGeek]

Re: Why is Kubuntu “phoning home”? Mysterious network activity!

Uninstall it.