First off I ran netstat -a to list all but it's 1,000 lines of 80+ chars / line and won't fit into a question. So I narrowed it down to netstat -l -e to list connections that are "listening" to my internet connection.

netstat -l -e Output:

$ netstat -l -e Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode tcp 0 0 dell:domain *:* LISTEN root 22501 udp 0 0 *:mdns *:* Me 6099032 udp 0 0 *:mdns *:* avahi 20093 udp 0 0 *:42320 *:* avahi 20095 udp 0 0 *:55304 *:* nobody 6096007 udp 0 0 dell:domain *:* root 22500 udp 0 0 *:bootpc *:* root 6091056 udp 0 0 *:ipp *:* root 5216701 udp6 0 0 [::]:mdns [::]:* Me 6099033 udp6 0 0 [::]:mdns [::]:* avahi 20094 udp6 0 0 [::]:57704 [::]:* avahi 20096 Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node Path unix 2 [ ACC ] STREAM LISTENING 24329 /run/user/1000/systemd/private unix 2 [ ACC ] SEQPACKET LISTENING 12608 /run/udev/control unix 2 [ ACC ] STREAM LISTENING 30872 @/tmp/.ICE-unix/2585 unix 2 [ ACC ] STREAM LISTENING 26927 /run/user/1000/keyring/control unix 2 [ ACC ] STREAM LISTENING 30821 /run/user/1000/keyring/pkcs11 unix 2 [ ACC ] STREAM LISTENING 20701 /sys/fs/cgroup/cgmanager/sock unix 2 [ ACC ] STREAM LISTENING 30986 /run/user/1000/pulse/native unix 2 [ ACC ] STREAM LISTENING 1153703 /run/user/1000/pulse/cli unix 2 [ ACC ] STREAM LISTENING 2303008 @Me-com.canonical.Unity.Master.Scope.files.T174165901748652 unix 2 [ ACC ] STREAM LISTENING 21329 @/tmp/.X11-unix/X0 unix 2 [ ACC ] STREAM LISTENING 2303016 @Me-com.canonical.Unity.Scope.files.T174166293059520 unix 2 [ ACC ] STREAM LISTENING 24726 /var/run/NetworkManager/private-dhcp unix 2 [ ACC ] STREAM LISTENING 25175 @/tmp/dbus-2IgIS5GS9B unix 2 [ ACC ] STREAM LISTENING 21330 /tmp/.X11-unix/X0 unix 2 [ ACC ] STREAM LISTENING 27881 /tmp/ssh-Y2H8jyF8xBOV/agent.2502 unix 2 [ ACC ] STREAM LISTENING 26969 /home/Me/.gnupg/S.gpg-agent unix 2 [ ACC ] STREAM LISTENING 30873 /tmp/.ICE-unix/2585 unix 2 [ ACC ] STREAM LISTENING 24397 @/tmp/dbus-ciisbyQXHo unix 2 [ ACC ] STREAM LISTENING 26572 /tmp/.com.google.Chrome.KSH5A2/SingletonSocket unix 2 [ ACC ] STREAM LISTENING 691516 @/tmp/dbus-BCetHWrk4L unix 2 [ ACC ] STREAM LISTENING 2303007 @Me-com.canonical.Unity.Master.Scope.applications.T174165894531763 unix 2 [ ACC ] STREAM LISTENING 12591 /run/systemd/private unix 2 [ ACC ] STREAM LISTENING 12596 /run/systemd/fsck.progress unix 2 [ ACC ] STREAM LISTENING 12609 /run/systemd/journal/stdout unix 2 [ ACC ] STREAM LISTENING 26932 @/com/ubuntu/upstart-session/1000/2381 unix 2 [ ACC ] STREAM LISTENING 2300330 @Me-com.canonical.Unity.Scope.scopes.T174169866065693 unix 2 [ ACC ] STREAM LISTENING 21636 /run/uuidd/request unix 2 [ ACC ] STREAM LISTENING 21637 /var/run/avahi-daemon/socket unix 2 [ ACC ] STREAM LISTENING 21638 /run/snapd.socket unix 2 [ ACC ] STREAM LISTENING 21639 /run/snapd-snap.socket unix 2 [ ACC ] STREAM LISTENING 21640 /var/run/cups/cups.sock unix 2 [ ACC ] STREAM LISTENING 21641 /var/run/dbus/system_bus_socket unix 2 [ ACC ] STREAM LISTENING 21642 /run/acpid.socket unix 2 [ ACC ] STREAM LISTENING 2300329 @Me-com.canonical.Unity.Scope.applications.T17416986049498 unix 2 [ ACC ] STREAM LISTENING 29796 @/tmp/ibus/dbus-NdbJULTU 

Note: I've replaced my Linux user ID with "Me" in the listing above.

I'm a little concerned that "Canonical" the manufacturer of "Ubuntu" is listening to my internet in many places. I don't recall big bold adverts of that happening nor ways of turning that "feature" off. I do have crash reporting turned on so maybe that is the reason. A detailed explanation in an answer would be appreciated though.

Are there known spyware / malware agents I can see using netstat?

Additionally can netstat help me track down internet performance blockers and kill a connection or two hundred? For example I see snapd is "listening" and just read it's a performance hog at times. Snapd is installed by default in 16.04 but I've never used it. I'll be researching it further and removing it.

Random snippets of netstat -a

As mentioned using netstat -a generates over 1,000 lines of output that won't fit into a 32KB AU question. Here are some random "snippets" of the full list to give you an idea of what appears.

From the middle

unix 2 [ ] DGRAM 6091044 unix 3 [ ] STREAM CONNECTED 28317 unix 3 [ ] STREAM CONNECTED 26391 unix 3 [ ] STREAM CONNECTED 29087 @/tmp/dbus-ciisbyQXHo unix 3 [ ] STREAM CONNECTED 7523056 unix 3 [ ] STREAM CONNECTED 41964 @/tmp/dbus-ciisbyQXHo unix 3 [ ] STREAM CONNECTED 36047 unix 3 [ ] STREAM CONNECTED 31024 unix 3 [ ] STREAM CONNECTED 25186 @/tmp/dbus-2IgIS5GS9B unix 3 [ ] STREAM CONNECTED 4258027 unix 3 [ ] STREAM CONNECTED 6835290 unix 3 [ ] STREAM CONNECTED 692478 @/tmp/dbus-BCetHWrk4L unix 3 [ ] STREAM CONNECTED 27314 @/tmp/dbus-2IgIS5GS9B unix 3 [ ] STREAM CONNECTED 29077 @/tmp/.X11-unix/X0 unix 3 [ ] STREAM CONNECTED 1033729 @/tmp/.X11-unix/X0 unix 3 [ ] STREAM CONNECTED 42812 unix 3 [ ] STREAM CONNECTED 29806 @/tmp/ibus/dbus-NdbJULTU unix 3 [ ] STREAM CONNECTED 6952286 unix 3 [ ] STREAM CONNECTED 161597 unix 3 [ ] STREAM CONNECTED 39839 unix 3 [ ] STREAM CONNECTED 33256 unix 2 [ ] DGRAM 33883 

From the bottom

unix 2 [ ] DGRAM 29074 unix 3 [ ] STREAM CONNECTED 55854 /var/run/dbus/system_bus_socket unix 3 [ ] STREAM CONNECTED 28997 @/tmp/.X11-unix/X0 unix 3 [ ] STREAM CONNECTED 21657 /run/systemd/journal/stdout unix 3 [ ] STREAM CONNECTED 28055 /run/systemd/journal/stdout unix 3 [ ] STREAM CONNECTED 24441 unix 3 [ ] STREAM CONNECTED 25875 /run/systemd/journal/stdout unix 3 [ ] STREAM CONNECTED 23525 unix 3 [ ] STREAM CONNECTED 691504 unix 3 [ ] STREAM CONNECTED 25897 @/tmp/dbus-ciisbyQXHo unix 3 [ ] STREAM CONNECTED 30179 

Forgive me if this question is rudimentary. I've just begun examining internet "connection stuff" and will look like a complete novice compared to those paid to work in this field.

1 Answer

The first time someone runs netstat it's a shocking experience. It seems like every creepy web site on the planet is watching your every move. And the reality is not that far from that perception.

Much of this connectivity is relatively benign. And a few of the connections are actually helpful, such as OS update connections. I would not be at all concerned about "Canonical connections" that are part of the Ubuntu software update model. Further, you will quickly find that trying to kill or block these hundreds of connections is futile.

You'll find that except for blatant port attacks, most of the connections you see via netstat originate from your web browser. You can control this to some degree but bear in mind that the more stuff you block, the more problems you will have when trying to do something useful on your web browser.

uBlock is a browser plugin that will drastically reduce the number of connections you see but will also reduce the functionality of your browser s ability to engage with various sites. Tightening up your environment versus being able to do real work is a constant balancing act.

Welcome to the Network Wild West :)