7

I am using netstat -acp | grep ESTABLISHED command to check established connection between with my system.

$ sudo netstat -acp | grep ESTABLISHED
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager  
tcp        0      0 rg-Vostro-3546:51874    server-18-66-78-6:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58112    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55592    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:43632    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:58128    199.232.22.137:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:48456    server-54-230-112:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:53632    server-18-161-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:55602    del12s08-in-f1.1e:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:36772    151.101.129.69:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:47712    server-54-192-111:https ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:59088    151.101.36.193:https    ESTABLISHED 2093991/brave --typ 
tcp        0      0 rg-Vostro-3546:44872    stackoverflow.com:https ESTABLISHED 2093991/brave --typ 
udp        0      0 rg-Vostro-3546:bootpc   _gateway:bootps         ESTABLISHED 750/NetworkManager

After opening the browser is establishing the connections with different IP's without any website/url being opened. Same thing happening for me in Firefox as well.

  1. Is it normal for a browser to establish connection like this.?
  2. If not,what should be the steps to get rid of this issue.?
2
  • 6
    Not opening a web page doesn't necessarily mean that it doesn't already display any resources from the web. Do you use browser extensions, toolbars, installed web apps, bookmarks? What's on your start screen/home page?
    – Bergi
    Mar 22, 2023 at 20:38
  • 4
    Your homework is to add -n to the netstat line, get all the destination IPs, and use whois to look up the owner of the block, and perhaps reverse DNS to give some clues. If you have specific destinations of concern then highlight them in the question. (example 151.101.129.69 is FASTLY which is a CDN, probably legit)
    – Criggie
    Mar 22, 2023 at 20:53

3 Answers 3

26

I'm not going to try and track down the individual connections in that list, but broadly speaking, yeah, it's extremely common for software to automatically make some TCP connections upon starting. Here are a few of the most common reasons:

  1. Checking for new versions. Even if you use a package manager rather than letting the app update itself, it might still check to see whether there's an update available (and pop up a message telling you to install it if so).
  2. Checking for updates to extensions/plugins/themes. Browser extensions update automatically (unless you go to some effort to prevent that), and the browser has to connect to the source of each extension (normally they all come from the same source but they don't have to) to see if new versions exist.
  3. Synchronizing across devices. If your browser (or other app) is signed into an account (such as a Google, Microsoft, or Firefox account), and syncs anything (browsing history, open tabs, autocomplete strings, passwords, etc.) then the app will automatically attempt to sync that data when it starts up.
  4. Home page triggering requests. Even through the home page is generally local to the browser (or other app, such as an IDE), it still might make background requests to pull things like news stories, suggested pages, image-of-the-day, or so on.
  5. Extensions that run on the home page triggering requests. Same as the previous point, but the scripts or content elements that trigger the request come from an extension rather than the home page itself.
  6. Extension background pages / plugin initialization code making requests. For example, an ad blocker or privacy enhancer might pull an updated list of content to block, or something like GoLinks might pull the latest list of short URLs that your organization uses. This is distinct from checking for extension updates, because those require publishing a new extension version with (potentially) new code, whereas this step simply pulls new data files and can be done far more often with much less hassle.
  7. Checking for updates to subscribed content. While most browsers no longer feature RSS feed readers, many sites still allow subscribing to various kinds of content that frequently update (e.g. Spotify pulling new podcasts and auto-generated personalized playlists).
  8. Telemetry. Arguably the "worst" of these, but it turns out that almost all serious apps (and quite a few non-serious ones) these days include telemetry to track information about how they're used, including how often they're run and on what sorts of systems. Such functionality - which may be present both in the main app, and in extensions/plugins - generally involves transmitting data which you may or may not have opted into at some point.
  9. For all of the above: checking for the revocation of certificates using Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP), both of which are done using TCP connections to the certificate authority (thanks for the reminder @Weirdo).

There are probably other cases (and #8 is arguably a few different ones, since there might be a lot things sending telemetry data, to a number of different locations) but that's a good set of example cases.

7
  • manytimes these ip endpoints are ec2 instances are well, if they are only for the purpose of information gathering then what is the need of established connection
    – Coder
    Mar 22, 2023 at 6:17
  • 11
    Another common request is a connectivity check to detect if logging into a wifi network is necessary.
    – kicken
    Mar 22, 2023 at 15:38
  • 6
    @Coder It's not uncommon for browsers to leave their connection to HTTPS servers open for some time after making a request so that they can potentially make later requests without having to take the time to open a brand new connection. Mar 22, 2023 at 19:24
  • 3
    Certificate Revocation Lists
    – Weirdo
    Mar 24, 2023 at 1:38
  • 5
    @Coder "the IP should be of the browser c ompany" - the browser company is not necessarily going to operate their own on-prem servers on their own IP range given the toil, cost, etc. They can purchase EC2 (or GCP, or Azure) cloud services, CDNs, hosted caches, etc just like anyone else.
    – nanofarad
    Mar 24, 2023 at 14:09
10

In most systems, this is the new normal.

There is vendor documentation on why you might find some of them desirable, as well as how to stop most automatic connections made by Firefox. However, as with most ad-sponsored software, the instructions are routinely rendered incomplete & outdated with each newly released version. They would not see such major adoption if each addition required informed consent.

Most connections broadly fall into these categories:

  • Updating: Including software components and metadata of saved tabs & bookmarks
    • e.g. Firefox might retrieve a current list of sites to endorse on your home page
  • Predicting soon-needed prerequisites and already establishing them
    • e.g. Firefox requests a database of potentially dangerous sites from Google, ready before using it to lookup your first navigation
  • Configuration: Some network (arguably: broken) configurations require active probing
    • e.g. only by actually trying Firefox can determine that it was pointed to a resolver deliberately returning incorrect results to point to a site managed by the wireless access point owner
  • Surveillance: The vendor collecting data on how the software is used or broken
    • e.g. Mozilla likes to base their decisions on how to proceed with rolling out new features and versions on how many people use them, and how many installations encountered obvious crashes
1
  • if the networking community thinks captive portals are broken they should make a non-broken way to make them happen
    – user253751
    Mar 23, 2023 at 1:34
3

It may be "normal", but it's not okay. At least for Firefox, there is a detailed guide published by Mozilla to disabling all of the huge number of "automatic connections" made for "telemetry" (a euphemism for surveillance), updates checking, support for their own/partner cloud services, captive portal & network accessibility detection, etc.:

https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections

After following that guide, in theory there should not be any connections made on startup. If there are, the list will be much smaller and more managable to track down what's still happening.

I have no idea if Brave has similar functionality. Brave is not really a privacy-respecting or -oriented browser, just somewhat misleadingly marketed as one. If you want to track down what it's doing, you could start by switching all the preferences as private as you can get them (including turning off their BAT cryptocurrency stuff) and see if you get a more managable list to investigate.

1
  • what about TOR, though has less no of established connections were there,private IPs was still there
    – Coder
    Mar 24, 2023 at 8:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .