15

For a little while now, a strange connection has been showing up on my netstat made by the command:

/usr/lib/gvfs/gvfsd-http --spawner :1.1 /org/gtk/gvfs/exec_spaw/2

By the time I notice it, the connection is always at the closed state. Every time I trace the IP address, it usually says that no website is registered.

I am unsure what activated this. It could be one of my browsers (Chrome and Firefox). I'm getting a little worried about this.

Could someone clue me in to what this could possibly be, and how to prevent the connection.

Eliah Kagan
  • 119,640
mloman
  • 1,017

4 Answers4

8

If the command

sudo watch netstat -tonp

shows a lot of connections caused by gvfs directly after booting, then you can consider to remove zeitgeist, geoclue, and/or ubuntu-one. You can also consider to deactivate the rhythmbox lastfm-plugin. As I don't need these programs I decided to remove them all and after the next boot, all strange gvfs connections disappeared.

The following page shows you how to remove some of these applications.

http://ubuntuforums.org/showthread.php?t=2000108

Be aware, that Zeitgeist is an essential part of Unity! So don't remove it, if you are using Unity.

Community
  • 1
user61712
  • 81
3

gvfsd is your Gnome Virtual File System. There is a fairly old bug that causes it to leave connections in the CLOSE_WAIT state for an undefined amount of time. It seems to be more an issue with RhythmBox more than another other program I've seen.

Some sources:

Ubuntu forums

Ubuntu forums 2

Linztm
  • 683
1

This will help you I think, so take a look:
https://bugs.launchpad.net/ubuntu/+source/gvfs/+bug/571970

Eliah Kagan
  • 119,640
pankaj sharma
  • 815
0

I found that gvfsd-http was connecting to a server called backoo.canonical.com

tcp  |  1  |  192.168.1.108:33427  |  backoo.canonical.com:www LAST_ACK

This was an IP-address of: 91.189.94.41 It would show up whenever I ran netstat -tu.

Alvar
  • 17,038
Explorer
  • 1