I notice that my system is continously downloading and uploading data even with me not doing anything. There are no browsers open. But in no time, already 500 mb has been downloaded and 500 uploaded. Seems like most of the activity are linux processes. Is there anyway I can stop some of these processes? Or a good app to monitor them more closely?
I don’t know about continually running apps but one thing the qubes system will do is check for updates for dom0 and each template when the system starts up but before any AppVMs have been launched.
One thing you can do to track down what is doing this is to run a network logging app on specific interfaces. I sometimes run etherape or tcpdump in sysfirewall on the internal interface to see which AppVM is sending specific traffic, or on the downstream interface to also watch what traffic sys-firewall (the update vm) might be adding to the network.
I have been long wanting a simple qubes specific app to cross correlate between AppVM processes and network traffic out the door so one can actually visualize what ones own system is doing with regards to potential leaking data from TOR or other VPN’s or just knowing where certain packets are comming from. This paradigm could help chase down rogue browser plugins or other software that might be giving someone else knowledge that you might preferr not to give them.
If you ever did get infected that traffic monitor might make that change stand out if it knew what was “normal” for your specific system. Just put an ML system in learning mode after the initial qubes install, and let it tell you when that traffic pattern suddenly changes. Accept that change or investigate where that new traffic came from.
1 Like
I believe it downloads a lot of data during the first minutes that Qubes and the AppVms starts. But after that, it calms down.