I found today what I thought was a misbehavior on Ubuntu when I connect to a new network interface. Turns out the culprit was Chrome.
In an effort to saturate this topic with more sources, here is a solution to what appears to be a Chrome security issue but is actually a feature. Apparently it is already known, but was not already known to me.
I had all services off and connected my NIC, capturing traffic for a VLAN compromise investigation, and instead of what I wanted to see, I kept seeing random domains that came back with a real IP address.
Host: kxzzskctf
Location: http://localhost
Expires: Fri, 12 Jun 2020 19:26:09 GMT
Cache-Control: no-cache
It became even more annoying when that connection was clearly operational but was not appearing on netstat.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
chrome 13467 user 41u IPv4 261742 0t0 TCP host:55652->198.105.244.23:http (CLOSE_WAIT)
chrome 13467 user 43u IPv4 261743 0t0 TCP host:55654->198.105.244.23:http (CLOSE_WAIT)
https://mikewest.org/2012/02/chrome-connects-to-three-random-domains-at-startup/
Apparently it is on purpose. Hopefully this will help someone else
Bookmarks