2 ms·
Could you try picosnitch? (disclaimer, I'm the author of it) It should be able to get the executable (and the hash of it) or at least give you a little more in
by elesiuta 3y ago
Could you try picosnitch? (disclaimer, I'm the author of it)
It should be able to get the executable (and the hash of it) or at least give you a little more information.
Of those I only see 151.101.193.91 which was used for nominatim.gnome.org and dl.flathub.org, with the executables /usr/libexec/gsd-datetime, /usr/bin/io.elementary.appcenter, and /usr/bin/flatpak.
With nethogs running for a few minutes I saw:
? root 192.168.2.10:42650-13.225.195.73:80
which I was able to see in picosnitch as /usr/sbin/NetworkManager connecting to 204.pop-os.org.
If there really was a boot or rootkit, you probably wouldn't see any trace of it at all in picosnitch, opensnitch, or nethogs, since it could be hiding at a lower level than whatever anything running on your system can detect, and would therefore need an external firewall.