strange IP connections in Cinnamon

[Mary]

Does anybody knows why cinnamon try to connects somewhere to these following IPs. There are no browser connection. No network applet. no applets running. Just idle system . 192.241.187.136:443 IP is always there. What does this mean and how to block it? thanks!
netstat -nputw
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 10.0.0.54:47756 18.213.160.206:443 TIME_WAIT -
tcp 32 0 10.0.0.54:44654 192.241.187.136:443 CLOSE_WAIT 2156/cinnamon
tcp 0 0 10.0.0.54:38614 204.2.200.150:443 TIME_WAIT -

[smurphos]

192.241.187.136 is openweathermap. Are you sure you haven't got the weather applet or desklet active?

[Mary]

yes absolutely. I switched it off. thinking that it maybe it.
if you try http://18.213.160.206/ it just gives you a smile face
192.241.245.161 -is Digital Ocean - but what it is and why its there. Fresh intsall

[smurphos]

If you switch either the weather applet or desklet off the connection will remain until you restart Cinnamon. It's not enough to just remove the applet or the desklet.

The other two IPs in your OP are who.is domains. Not sure what you are running to see those.

192.241.245.161 also resolves to openweathermap

[MrEen]

The other two IPs in your OP are who.is domains. Not sure what you are running to see those.

The first is Amazon, and is probably the connection for the OP's update mirror. That is a guess, but could be tested by changing mirrors and rebooting to see if both it and the weather one disappear.

[shockedquartz]

I've just wasted about 3 hours trying to figure out the same thing.
The PIDs were showing as cinnamon --replace
and nothing relative under ps aux --forest view

It's really hard to track down TCP connections for cinnamon.
lsof doesn't really show WHAT is creating the stream!
I got lucky and found this post.

Ranges:
104.26.0.0/24
192.241.0.0/24

I disabled the applet and restarted cinnamon and confirmed it in netstat
Applet back on:

Code: Select all

netstat -peanut | grep cinnamon
tcp        0      0 localhost:55820    104.26.9.44:443         ESTABLISHED 1000       3440156    29499/cinnamon      
tcp       32      0 localhost:57358    192.241.245.161:443     CLOSE_WAIT  1000       3440157    29499/cinnamon 

lsof -p 29499 -i 4
blaaaaaaaaaahhhhhhhhhh....
cinnamon  29499          me  43u     IPv4            3440156      0t0      TCP this.lan:55820->104.26.9.44:https (ESTABLISHED)
cinnamon  29499           me   45u     IPv4            3440157      0t0      TCP this.lan:57358->192.241.245.161:https (CLOSE_WAIT)