iftop, outgoing https to Amazon

Question

When I run iftop -P to see what is coming to/from my interface, I constantly see connections to Amazon, HTTPS protocol:

=> ec2-176-34-135-167.eu-west-1.compute.amazonaws.com:https
<=
=> ec2-52-22-162-249.compute-1.amazonaws.com:https
<=
...

Those connections reappear when I close and open my browser (Iceweasel, Debian testing). I cleared the cache and cookies but this is somehow persistent. I also disabled Amazon as a search engine. I do not own a cloud storage, neither a virtual machine on AWS.

How to trace the source of those connections?

Best Regards,
Kamil

EDIT

Output of lsof -i -nP, as requested by @thrig

iceweasel 8596 user   38u  IPv4  90162      0t0  TCP 192.168.0.15:49156->216.58.209.78:443 (ESTABLISHED)
iceweasel 8596 user   47u  IPv4  90186      0t0  TCP 192.168.0.15:51544->52.25.142.225:443 (ESTABLISHED)
iceweasel 8596 user   53u  IPv4  86275      0t0  TCP 192.168.0.15:42090->52.32.59.229:443 (ESTABLISHED)
iceweasel 8596 user   55u  IPv4  90184      0t0  TCP 192.168.0.15:50570->52.11.148.42:443 (ESTABLISHED)
iceweasel 8596 user   56u  IPv4  87223      0t0  TCP 192.168.0.15:44370->54.187.136.191:443 (ESTABLISHED)

Hmm, there is Google too, maybe those are search engines updates?
NO. I disabled search engines autoupdates and restarted the browser. I also disabled Firefox (Iceweasel) Sync service, didn't help (I thought that maybe they store my data in Amazon cloud).

Hmmm, lsof (after Iceweasel close/open) says it is iceweasel process. Please, see EDIT section in the original post. — Kamil, Dec 23 '15 at 22:49

score 1 · Answer 1 · answered Dec 24 '15 at 01:00

Firefox periodically connects to distribution servers update some internal databases. There's at least:

SSL certificate revocation information;
A blacklist of known malware sites (Google Safe Browsing).
The current version of Firefox and of the extensions you have installed, to prompt you for updates.

I don't know where these services are hosted but given that Amazon is (one of?) the largest web hosting providers I wouldn't be surprised if they hosted some or all sources of automatic updates.

If you visit about:config and search for https://, you'll see a list of sites that Firefox might connect to. This includes sites that it automatically connects to as well as sites that it only connects to on some explicit user action (e.g. to browse extensions, access online help, etc.). Some plugins and extensions also have preferences listed there.

Generally, apart from update availability checking for Iceweasel (which should be disabled since the updates will be coming from Debian), what Firefox itself downloads automatically are desirable things, and you should only disable them if you have a good reason (e.g. a pay-per-minute connection that goes up automatically). I can't speak for whatever plugins or extensions might do by default.

iftop, outgoing https to Amazon

1 Answers1