Hello all,
According to the Wireshark record my computer connects to various services often, including Amazon, Hetzner, 1337 Services GmbH, Evanzo GmbH and ThomasFamilyInvestments. The most often were the connections to mail.my-mail.rocks which is a part of Netcup GmbH. I have a somewhat minimal distro and the attached recordings were made when no app was open including no browser. I can send the other screenshots showing other connections too. I’m suspecting of malware since some time ago but can you help me clarify these connections please?
Use Portmaster
This is the way
Portmaster is mandatory nowadays, like also InviZible Pro in Android
Oooooo I haven’t seen that one before, thanks!
I find wireshark too confusing unless you have a lot of experience with it.
It looks like you are using linux because I see Wlan0 at the top of the image
I use ss
ss --help
to see what you are connecting to
ss -x -a
ss -o state established
ss -o state established ‘( dport = :http or sport = :http )’
what processes are using open sockets
ss -pl
TCP sockets
ss -t -a
UDP sockets
ss -t -a
a deeper guide here:
https://www.cyberciti.biz/tips/linux-investigate-sockets-network-connections.html
SS is a weird name but ok.
Just open sudo ss -tulpn u will see all programs with opened port and u will killing disabling until u will find source of network noise
That mail/[.]my-mail/[.]rocks maps to the tor network.
https://metrics.torproject.org/rs.html#details/E3F16EEB32F9C0B28325891F7BAACA8EC212343D
so am i running a relay in the background although tor browser is closed?
If it’s like a vpn interface, it’s still running as a deamon in the background even if the browsers are closed.
Like others have said you can check what application is using each open port. You can also check running processes (ps | grep keywords) and interfaces (ip a).
Because you’re on the internet
Does also your computer connect to Amazon, Hetzner, 1337 Services GmbH, Evanzo GmbH and ThomasFamilyInvestments without a reason?
Everything has a reason