hello,

what's the unity-scope-video-remote package in my computer, and why is it sending tcp packets without a previous syn (no connection established) ?

Hi there,

This package seems to be a remote video search engine, and a quick google seems to indicate other people also complaining about unwanted network connections. I'm not sure what TCP packets without a previous SYN could be, though. What does "netstat -atulpen" show for this process?

Regards, Clifford

What's a 'remote video search engine' ? Is it some kind of software that searches additional information about the video that is being played ? In that case, which video player is it bound to ? I did that netstat command but it [edit:its output] raised too many suspicions so I uninstalled it [edit:the unity-scope-video-remote package] in the meantime. But I remember that the IP to which it was connected belonged to canonical (port 80), and that it was not in a established state (something like 'CLOSE_WAIT' maybe, I'm not sure anymore, sorry), which is something my firewall picked up too, and why it raised the alert.

also see: https://bugs.launchpad.net/ubuntu/+bug/944251

Hi there,

I don't use Unity, so I'm a little out of my depth here. This article might explain what it does, though:
http://www.omgubuntu.co.uk/2012/02/u...-shows-online/

If you don't like this, you can uninstall it with:
Regarding netstat, what do you mean by "it raised too many suspicions"? It is a standard tool on all Unix installations, and I'd strongly recommend against uninstalling it in most cases. See https://en.wikipedia.org/wiki/Netstat for more information on it.

On the TCP connection, CLOSE_WAIT represents waiting for a connection termination request acknowledgment from the remote TCP, i.e. your machine has requested that the connection be closed, and is waiting for the remote server (Canonical) to acknowledge this. A SYN flag must have been set on earlier packets to establish the connection first.

I hope this makes sense....

What I meant is that the output of that netstat command were suspicious (unknown and unwanted connection to canonical, phone home or whatever) and made me remove the package, which is what I did using the command line you just gave. A SYN flag was not sent, this is what iptables warned me about: The firewall allows all outgoing traffic as long as it was initiated before. This was not the case, hence the packet was dropped and raised the alert.

Thank you for the description link of that unity feature. Upon Reading it, I still don't understand why it would require a continuous TCP connection to canonical servers, rather than just one when the query is made. In any case, this is not a feature I want, if I want to go to youtube, I'd rather use my web browser than a commercial built in search engine that doesn't even display real youtube.
So I had uninstalled that package, and I won't reinstall it.

Problem solved.
Thanks

Ah, that makes sense:-) Glad you came right!