Hello. I have linux slackware 14.2 kernel 4.4.29, iptables 1.6.0.
I have standard rule in iptables.
Last half year I saw many connections on port 5228. There connections are
from Androids machine like tablets, smarfones, and especially most are from Sony Bravia. There connections are from Google on port 5228
Problem is that connection is open, status is ESTABLISHED even I turn off devices. After few days is 100-1000 unused connections, so I delete it in night, but it's poor solution. Why google's machines makes connection and doesn't close it. Other connections like www, ftp work fine. When I turn off device connection its goes to status CLOSED. What can

It's example from iptstate. Last row is time in hours of keeping connection.

10.x.x.x:53572 64.233.163.188:5228 tcp ESTABLISHED 9:20:16
10.x.x.x:38067 64.233.162.188:5228 tcp ESTABLISHED 14:36:09
10.x.x.x:58414 64.233.162.188:5228 tcp ESTABLISHED 19:34:06
10.x.x.x:51076 64.233.162.188:5228 tcp ESTABLISHED 14:47:26
10.x.x.x:37819 64.233.162.188:5228 tcp ESTABLISHED 23:52:22
10.x.x.x:37225 64.233.162.188:5228 tcp ESTABLISHED 4:16:41
10.x.x.x:34369 64.233.161.188:5228 tcp ESTABLISHED 8:33:46
10.x.x.x:53083 173.194.220.188:5228 tcp ESTABLISHED 10:35:32
10.x.x.x:33581 64.233.161.188:5228 tcp ESTABLISHED 23:42:44
10.x.x.x:45411 64.233.164.188:5228 tcp ESTABLISHED 1:50:33
10.x.x.x:32788 64.233.162.188:5228 tcp ESTABLISHED 0:45:30
10.x.x.x:59684 64.233.165.188:5228 tcp ESTABLISHED 26:34:44
10.x.x.x:39336 64.233.165.188:5228 tcp ESTABLISHED 1:17:20
10.x.x.x:51913 173.194.222.188:5228 tcp ESTABLISHED 0:00:20
10.x.x.x:41902 64.233.165.188:5228 tcp ESTABLISHED 22:47:26
10.x.x.x:35680 64.233.162.188:5228 tcp ESTABLISHED 5:12:47
10.x.x.x:38752 173.194.71.188:5228 tcp ESTABLISHED 5:14:54
10.x.x.x:34181 64.233.162.188:5228 tcp ESTABLISHED 3:48:25
10.x.x.x:38325 64.233.162.188:5228 tcp ESTABLISHED 10:24:02
10.x.x.x:45075 64.233.161.188:5228 tcp ESTABLISHED 13:38:33
10.x.x.x:39640 173.194.220.188:5228 tcp ESTABLISHED 11:13:32
10.x.x.x:45386 64.233.163.188:5228 tcp ESTABLISHED 2:47:23
10.x.x.x:34497 64.233.161.188:5228 tcp ESTABLISHED 18:33:14
10.x.x.x:47087 173.194.222.188:5228 tcp ESTABLISHED 23:27:44
10.x.x.x:34312 173.194.71.188:5228 tcp ESTABLISHED 23:47:25
10.x.x.x:56209 173.194.220.188:5228 tcp ESTABLISHED 24:25:49
10.x.x.x:35651 64.233.165.188:5228 tcp ESTABLISHED 13:32:54
10.x.x.x:40134 64.233.165.188:5228 tcp ESTABLISHED 14:04:11
10.x.x.x:49132 64.233.162.188:5228 tcp ESTABLISHED 3:45:29
10.x.x.x:36529 209.85.233.188:5228 tcp ESTABLISHED 2:22:21
10.x.x.x:48726 64.233.162.188:5228 tcp ESTABLISHED 23:03:28
10.x.x.x:34578 173.194.71.188:5228 tcp ESTABLISHED 20:35:05
10.x.x.x:45617 64.233.165.188:5228 tcp ESTABLISHED 1:32:18
10.x.x.x:51344 64.233.162.188:5228 tcp ESTABLISHED 22:35:33

I did an Openfire xmpp deployment back in June 2014

from http://stackoverflow.com/questions/1...ication-server
The device accesses the GCM servers on ports 5228-5230. If your organization has a firewall that restricts the traffic to or from the Internet,
you'll need to configure it to allow connectivity with GCM. The ports to open are: 5228, 5229, and 5230. GCM typically only uses 5228, but it
sometimes uses 5229 and 5230.

What it means? Don't know. I just recognized the port.
jabber?

Linux is connecting with port 5228, but doesn't close when device is turn off.

You are making connections to Google, not the other way around.

This port-number is also used for "cloud printing" services, and I idly wonder what your printing subsystem might be doing . . .

Which process has those ESTABLISHED connections? Obviously, someone does. I wonder if it is CUPS.

I don't use any printers