Hello,
Not sure if this is the proper forum to ask but (Running suse 13.1) I’ve been noticing that my network connection is constantly busy even if I’m not logged on or not doing anything that might directly involve the network. After a little investigation I found that ktorrent was the source of much (>90%) of the traffic. Not finding where it was being launched from, I issued a kill -9 to it and bango no traffic and no discernible issues.
All of which leads to a couple of questions I’m hoping more knowledgeable persons might help with:
Any thoughts on where/who might be launching ktorrent? KDE I’m sure must be involved and
I do run KDE.
Any thoughts that I might have been infected with some sort of BOT/malware which is trying to
use my machine? At this point I’m running just fine without ktorrent. Of course it is always possible
I started it up inadvertently at some time in the past and it’s just hanging on.
Thanks for your consideration and thoughts.
JJefferies
No I didn’t track it back. I did try to see who the connection was with using whois
but that didn’t provide anything meaningful to me.
Here is part of what netstat reported
netstat -anp --inet
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8822 0.0.0.0:* LISTEN 764/smfpd
tcp 0 0 0.0.0.0:631 0.0.0.0:* LISTEN 677/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 3788/master
tcp 0 0 192.168.1.64:34556 91.121.220.5:44998 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:41558 124.109.2.169:6951 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:58710 208.81.1.244:51413 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:55780 153.121.48.76:6881 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:41037 108.185.134.138:65450 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:41458 82.24.11.12:19697 ESTABLISHED 3958/ktorrent
tcp 0 316 192.168.1.64:36539 177.42.194.228:13293 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:52546 128.71.93.196:51413 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:55020 46.188.49.98:51413 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:60540 89.182.66.81:41389 ESTABLISHED 3958/ktorrent
tcp 0 0 192.168.1.64:32921 69.248.18.151:46133 ESTABLISHED 3958/ktorrent
Thanks. Think ktorrent was turned on a sometime ago for some unremembered reason
and was just never shut off properly. I get suspicious what with all the BOT stories.
And so it’s no longer seeding. Just not able to find any *.torrent files to confirm that
it was just sitting there and not up to no good.
Yes, this is likely. It’s icon usually sits hidden in the tray, where you won’t notice it. And if you don’t close it before you logout of KDE, then you probably have it set to restart it on the next login.
You should be able to open ktorrent now. Then click on the icon in hidden tray items. Then see what files it thinks it is currently handling. That might give you an idea on what it was doing.
I thought that you would have done a form ofthe p stateennttto find it before you did the kill. And that shows of course it’s owner. But you may have done different. Never mind.
BTW
Seeing your computer text above, I will copy/paste the following that I often send to new members:
Please in the future use CODE tags around copied/pasted computer text in a post. It is the # button in the tool bar of the post editor. When applicable copy/paste complete, that is including the prompt, the command, the output and the next prompt.
Probably the simple question should be if you’ve looked at the app configuration.
Although I don’t run ktorrent, many similar apps have a setting that starts up the app on bootup or in the case of a KDE app more likely automatically on login.