Strange connections to external network after update

[Алексей Ерыгин]

Hello,

After updating Confluence to 6.4.2 there are some strange connections to external network;

tcp        0      1 localip:40620           74.125.131.139:80           SYN_SENT
tcp        0      1 localip:40628           74.125.131.139:80           SYN_SENT
tcp        0      1 localip:40600           74.125.131.139:80           SYN_SENT
tcp        0      1 localip:40632           74.125.131.139:80           SYN_SENT
tcp        0      1 localip:40622           74.125.131.139:80           SYN_SENT

Does anybody know what IP is it and how to disable such connections through Confluence configuration?

[Zak Laughton · Accepted solution]

Hi Алексей!

The 74.125.131.139 IP address is registered to Google. Based on the SYN_SENT status, it appears these connections are being attempted, but aren't actually making the connection to reach an ESTABLISHED status (possibly already blocked by a firewall on the system).

As for what is sending these connections, I haven't seen Confluence try to make external connections like this, but we have seen third-party plugins attempt to connect to Google, usually to track usage via Google Analytics. Often, these plugins will have a "Send usage statistics" option in their settings.

To confirm or rule this out, I recommend temporarily turning on  Safe Mode to disable all third-party plugins, and see if the connection attempts continue. You can also check any known settings of any third-party add-ons at  > General Configuration to see if there are any enabled "Send usage data"-type options.

- Zak

[Алексей Ерыгин]

Hi Zak,

You was right. It is exactly third party plugins (ServiceRocket set of plugins). As default, these plugins send analytic information to developers.

Accept your asnwer as a solution.

Thank you very much.

[Zak Laughton]

Glad I could help!