Why is this outbound traffic originating from the tradenote container?

[lapse00]

Hello,

Concerned about privacy, I decided to deploy this solution. By sniffing outbound traffic with a container deployed on the same network as the tradenote container, I found this:

19:41:26.006292 eth0  Out IP 8e983dae0c62.45842 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 791705676, win 64240, options [mss 1460,sackOK,TS val 4030211411 ecr 0,nop,wscale 7], length 0
19:41:27.018846 eth0  Out IP 8e983dae0c62.45842 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 791705676, win 64240, options [mss 1460,sackOK,TS val 4030212424 ecr 0,nop,wscale 7], length 0
19:41:28.042874 eth0  Out IP 8e983dae0c62.45842 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 791705676, win 64240, options [mss 1460,sackOK,TS val 4030213448 ecr 0,nop,wscale 7], length 0
19:41:29.066869 eth0  Out IP 8e983dae0c62.45842 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 791705676, win 64240, options [mss 1460,sackOK,TS val 4030214472 ecr 0,nop,wscale 7], length 0

I had previously applied an iptables rule to block outbound internet access for DOCKER-USER.

What is this for? ec2-54-210-243-92.compute-1.amazonaws.com.443

Certificate:

Common Name (CN)	*.docker.com
Organization (O)	<Not Part Of Certificate>
Organizational Unit (OU)	<Not Part Of Certificate>

Thank you

[lapse00]

Or this one:

20:02:19.658852 eth0  Out IP 8e983dae0c62.50092 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 3930891225, win 64240, options [mss 1460,sackOK,TS val 3086749742 ecr 0,nop,wscale 7], length 0
20:02:20.016967 eth0  Out IP 8e983dae0c62.47604 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 1146409899, win 64240, options [mss 1460,sackOK,TS val 3086750100 ecr 0,nop,wscale 7], length 0
20:02:20.682849 eth0  Out IP 8e983dae0c62.50092 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 3930891225, win 64240, options [mss 1460,sackOK,TS val 3086750766 ecr 0,nop,wscale 7], length 0
20:02:21.034851 eth0  Out IP 8e983dae0c62.47604 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 1146409899, win 64240, options [mss 1460,sackOK,TS val 3086751118 ecr 0,nop,wscale 7], length 0
20:02:21.706846 eth0  Out IP 8e983dae0c62.50092 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 3930891225, win 64240, options [mss 1460,sackOK,TS val 3086751790 ecr 0,nop,wscale 7], length 0
20:02:22.058868 eth0  Out IP 8e983dae0c62.47604 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 1146409899, win 64240, options [mss 1460,sackOK,TS val 3086752142 ecr 0,nop,wscale 7], length 0
20:02:22.730855 eth0  Out IP 8e983dae0c62.50092 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 3930891225, win 64240, options [mss 1460,sackOK,TS val 3086752814 ecr 0,nop,wscale 7], length 0
20:02:23.082869 eth0  Out IP 8e983dae0c62.47604 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 1146409899, win 64240, options [mss 1460,sackOK,TS val 3086753166 ecr 0,nop,wscale 7], length 0
20:02:23.754865 eth0  Out IP 8e983dae0c62.50092 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 3930891225, win 64240, options [mss 1460,sackOK,TS val 3086753838 ecr 0,nop,wscale 7], length 0
20:02:24.106860 eth0  Out IP 8e983dae0c62.47604 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 1146409899, win 64240, options [mss 1460,sackOK,TS val 3086754190 ecr 0,nop,wscale 7], length 0
20:02:25.130864 eth0  Out IP 8e983dae0c62.47604 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 1146409899, win 64240, options [mss 1460,sackOK,TS val 3086755214 ecr 0,nop,wscale 7], length 0
20:02:25.770862 eth0  Out IP 8e983dae0c62.50092 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 3930891225, win 64240, options [mss 1460,sackOK,TS val 3086755854 ecr 0,nop,wscale 7], length 0

[7aklhz]

To my knowledge, the only possible outbound traffic is https://tradenote.co/explanations.html#analytics. Anything else must be something in the supporting modules... but that would be weird.

[lapse00]

Nop.

I have modified docker compose adding ANALYTICS_OFF: true , but traffic keeps going out, and the application has stopped working. It gets stuck loading on any option: Dashboard, Daily, etc.

20:22:36.682861 eth0  Out IP 9c8a468e436b.53374 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 2411038079, win 64240, options [mss 1460,sackOK,TS val 3021101156 ecr 0,nop,wscale 7], length 0
20:22:37.706849 eth0  Out IP 9c8a468e436b.53374 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 2411038079, win 64240, options [mss 1460,sackOK,TS val 3021102180 ecr 0,nop,wscale 7], length 0
20:22:38.243152 eth0  Out IP 9c8a468e436b.55056 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 2632587359, win 64240, options [mss 1460,sackOK,TS val 765162435 ecr 0,nop,wscale 7], length 0
20:22:38.730982 eth0  Out IP 9c8a468e436b.53374 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 2411038079, win 64240, options [mss 1460,sackOK,TS val 3021103204 ecr 0,nop,wscale 7], length 0
20:22:39.274861 eth0  Out IP 9c8a468e436b.55056 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 2632587359, win 64240, options [mss 1460,sackOK,TS val 765163467 ecr 0,nop,wscale 7], length 0
20:22:39.754870 eth0  Out IP 9c8a468e436b.53374 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 2411038079, win 64240, options [mss 1460,sackOK,TS val 3021104228 ecr 0,nop,wscale 7], length 0
20:22:40.298867 eth0  Out IP 9c8a468e436b.55056 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 2632587359, win 64240, options [mss 1460,sackOK,TS val 765164491 ecr 0,nop,wscale 7], length 0
20:22:40.778841 eth0  Out IP 9c8a468e436b.53374 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 2411038079, win 64240, options [mss 1460,sackOK,TS val 3021105252 ecr 0,nop,wscale 7], length 0
20:22:41.322866 eth0  Out IP 9c8a468e436b.55056 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 2632587359, win 64240, options [mss 1460,sackOK,TS val 765165515 ecr 0,nop,wscale 7], length 0
20:22:42.346865 eth0  Out IP 9c8a468e436b.55056 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 2632587359, win 64240, options [mss 1460,sackOK,TS val 765166539 ecr 0,nop,wscale 7], length 0
20:22:42.794863 eth0  Out IP 9c8a468e436b.53374 > ec2-54-210-243-92.compute-1.amazonaws.com.443: Flags [S], seq 2411038079, win 64240, options [mss 1460,sackOK,TS val 3021107268 ecr 0,nop,wscale 7], length 0
20:22:43.370868 eth0  Out IP 9c8a468e436b.55056 > ec2-98-80-106-17.compute-1.amazonaws.com.443: Flags [S], seq 2632587359, win 64240, options [mss 1460,sackOK,TS val 765167563 ecr 0,nop,wscale 7], length 0

[C8opmBM]

I am very interested in this as well.
Could we maybe dig deeper?

[7aklhz]

My time is very limited but yes if you can investigate that would be great. One thing is for sure, I'm not making any calls to your server so my theory is that one of the modules / external libraries are.

[Marmaduke1st]

Thought this had answer my prayers but this worries me.

Any answer on this yet?

[Pixelherz23]

bump. Any updates?

[C8opmBM]

@7aklhz is working on a refresh version.