My guess would be an online connectivity check. Most systems try and reach some domain to say if they have network or not. Would be a logical place for them to try.
this post was submitted on 21 Apr 2025
20 points (85.7% liked)
Privacy
37933 readers
923 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Or NTP sync
I haven't trusted Ubuntu since the Amazon ad debacle.
Wiped my drive, installed Debian, and haven't looked back.
Fuck Canonical.
I don't use Ubuntu cause of snap. What happened with Amazon ads?
Also ive never found any benefit from ubuntu-server over base debian. What the fuck is the difference?
Back inbthe mid 00s, Canonical decided to send our searches to Amazon and show us ads in the system search results.
Debian is the parent of Ubuntu. It's more stable, and doesn't have the corporate influence to enshitify it.
Thats wild. Fuck Canonical.
It may be the basic ubuntu telemetry (relatively non-invasive, but still a concern for the privacy-minded) sent by this tool unless you opted out at install:
https://github.com/ubuntu/ubuntu-report
from that page:
So it would not surprise me if it was scheduled to send, failed, and then re-triggered upon activation of a new network connection (the VPN).
Edit: Or even more likely, it is a connection from networkmanager to connectivity-check.ubuntu.com
https://ubuntu.com/core/docs/networkmanager/snap-configuration/connectivity-check
tcpdump that shit
It's almost certainly related to cloud-init, (the canonical tool for handling deployment automation) or Ubuntu pro (extra long support for backporting security packages to older distros, plus some conveniences). They're pre installed as a convenience to paid users of those services, that's the (IMHO, quite reasonable) model they use to fund the distro. I would expect that some or all of that traffic would disappear if you disable/remove those two services.
Sniff the packets and see if you can determine what the data is.
What exactly is the connection?
DNS?