Network monitoring - What data/file is being sent to a server?

Ask Fedora
1

Hello all

So coming from Windows, i might be a little paranoid :wink:

Not that it has bothered me much, i have just turned of and blocked whatever i could find, so MicroSLOP would get minimum from me.

Is there any app that lets me see exactly what file, data is being sent from?

I’m trying Portmaster out, but it only tells me the folder it sends from and receives to. That didn’t help me much, as there were a lot of files in that folder, and more folders within, also with files in them.

All the best
Carsten

2

Fedora has a countme feature that dnf updates will allow fedora to know you are a user.
You can turn that off.

Firefox is worth looking at.

Otherwise I not aware of any app sharing any info from your system.

3

strace will tell you exactly what any program does, what it reads from where it writes to. It’s
closest Windows equivalents would be ProcMon or ProcExplorer.

4

Thank you @anothermindbomb :slight_smile:

That sound interesting, i’ll have a look into that :slight_smile:

5

Indeed. Firefox no longer have a setting to turn off sending usage information to Mozilla. Or the setting is now hidden in about:config.

6

Fedora sends a ping to fedoraproject.org to determine internet connectivity to display the correct icon.

7

Villy, Barry and Flo.

I know i didn’t specify the app i wanted to check - but i didn’t think that it would lead to talks about different apps sending data.

I asked for an app that could tell me exactly what was sent - not which app sent something.

I know exactly what i’m tracking, i just can’t - as i wrote - pinpoint what’s being sent - and received.

I will not tell you what app it is for now, as i want to be sure what’s going on first. I have for now uninstalled the app, because the developer evaded my questions in regards to why the app needed to be online all the time and what data was sent.

8

Given you know the app you want to investigate strace is the tool I would start with.
strace allows you see all the system calls the app makes.

That is often too much information, but you can focus strace to watch specific system calls.
For example it may be good enough to strace file open operations if you are focusing on which files are accessed.
Or you might strace socket writes to see what data is exfiltrated.

You can also use witeshark to watch for network activity.
But is the traffic is encrypted you will not be able to see what data is exfiltrated only where it was sent.

9

As Barry said, Wireshark is a good network analysis tool.
There is also now a Linux version of Little Snitch which used to be great on the Mac.
If you want to be sure you are viewing ALL network traffic, you can find custom router solutions or some high end routers to do that.

As far as the OS goes, it is nothing like Slop or Crapple for phoning home.