Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

firefox on ubuntu triggers huge download in the background

  • 6 replies
  • 1 has this problem
  • 18 views
  • Last reply by John99

csekar
csekar
more options

I am using ubuntu 14.04.02, and firefox 44.0.2. Recently I noticed, my downloads were going really high but I never downloaded anything. After step by step debugging, I could find that the moment I open few tabs in firefox, some download starts in the background. I monitored

$ ifconfig eth0 | grep 'RX bytes'

every second and I could notice that within 5-6 mins, close to 200 MB is downloaded. I can reproduce this at will. I used wireshark and capture packets and saw the below connection is the one causing all downloads.

132074 185.236936000 143.95.251.18 192.168.1.4 TCP 1454 [TCP segment of a reassembled PDU]

I tried tracing the IP and which goes to some " athenix inc " I have no idea about that site and everytime I open firefox it downloads the data from the same IP.

I don't see the problem with Chrome (not sure about firefox on Windows). I can see the same behavior in my laptop and desktop (Both are Ubuntu 14.04.02 and firefox 44.0.2) Can someone help me to find what's wrong? How to approach this? Is this some security issue? Thanks in advance.

Please tell me if you want any data from me, I can share it.

I am using ubuntu 14.04.02, and firefox 44.0.2. Recently I noticed, my downloads were going really high but I never downloaded anything. After step by step debugging, I could find that the moment I open few tabs in firefox, some download starts in the background. I monitored $ ifconfig eth0 | grep 'RX bytes' every second and I could notice that within 5-6 mins, close to 200 MB is downloaded. I can reproduce this at will. I used wireshark and capture packets and saw the below connection is the one causing all downloads. 132074 185.236936000 143.95.251.18 192.168.1.4 TCP 1454 [TCP segment of a reassembled PDU] I tried tracing the IP and which goes to some " athenix inc " I have no idea about that site and everytime I open firefox it downloads the data from the same IP. I don't see the problem with Chrome (not sure about firefox on Windows). I can see the same behavior in my laptop and desktop (Both are Ubuntu 14.04.02 and firefox 44.0.2) Can someone help me to find what's wrong? How to approach this? Is this some security issue? Thanks in advance. Please tell me if you want any data from me, I can share it.

All Replies (6)

John99
John99
more options

Not sure what is happening. I am not in Ubuntu, but I will try some time over the next couple of days to see if I can reproduce.

This may be a bit of a longshot and a red herring. What re your privacy settings in Ubuntu ? I am thinking about their default setting where Ubuntu searches the net when you search your computer, that may well use your default browser.

See also How to stop Firefox from making automatic connections

csekar
csekar Question owner
more options

Thanks John for looking into this. I attached the privacy setting as a screenshot. I will go through the link and see if that helps. Please let me know if you need any other data from me.

John99
John99
more options

Sorry I did not make my suggestion clear. I meant you to look at Ubuntu's settings. By default they track your internal searches on the computer and provide helpful info in the Dash.

The attached images enlarge when clicked.

I can not say I see any large background downloads. I do have wireshark installed, but it is years since I last used wireshark and I am not too certain how to use it now.

For me $ ifconfig eth0 | grep 'RX bytes' 

         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

$ ifconfig wlan0 | grep 'RX bytes' 

         RX bytes:22992415 (22.9 MB)  TX bytes:6640808 (6.6 MB)

A few minutes later 

          RX bytes:23939260 (23.9 MB)  TX bytes:7008141 (7.0 MB)

I normally just glance at System Monitor -> |Resource| -> Network History

I tested on Ubuntu 14.04 (Ubuntu 14.04.3 LTS) and Canonical Fx43.0.4 with a lot of tabs open.

I have later versions of Firefox; and also Iceweasel; on Debian and am not noticing unexpected large background downloads on those either.

John99
John99
more options

I am updating Ubuntu and the distro's Firefox at the moment and will see if if I then notice issues. I will post back if I see problems.

Have you tried opening Firefox in it's safe mode and with only a blank tab open do you still see a problem then?

P.S. You did say with a few tab open. Try with just blank tabs "about:blank" If you need to have online tabs open to see the issue please try with tabs just opened to support.mozilla.org that way we should be able to rule out issues with the website.


Modified February 16, 2016 at 9:55:01 AM GMT by John99

P.P.S. Now updated: Not noticing problems on Ubuntu with Canonical Fx44.0.2 or Mozilla Fx46.0a2 (2016-02-16)

Modified by John99

csekar
csekar Question owner
more options

Thanks a lot John for your kind suggestions. I am not able to see the exact problem now. But I still see lot of unrelated packets going on. As you suggested I just opened only support.mozilla.org. I couldn't see the issue, so I opened my regular websites and closed them. But I can see few websites open more than 10 connections and keep transferring something. But for sure I am not seeing the earlier issue, I have opened firefox for more than 20 mins, only 20 - 30 mb transferred. That's not a big concern now.

BTW, I ran rkhunter and didn't see any issues as well. I don't see the problem now, I will do extensive testing probably during the weekend and see if I can notice anything or collect anything useful.

Big thanks for your kind suggestions, was very helpful.

John99
John99
more options

Sounds like it is behaving for now, that's good.