Slow traffic pass through "disconnected" wired connection

[Dawie Steynfaard]

I was doing a fresh install of 12.04 on my desktop PC, which is connected to my home network. I have installed the Gnome3 classic desktop environment, and while doing some configurations, I decided to disconnect from the network in order to protect my PC while it is still in a vulnerable state. (I have noticed for some time before that one of the other PC's on the LAN, with a Win 7 OS, is somewhat noisy on the network).

When installing the System Monitor applet, I also activated the Network portion, taking samples at 1.5 second intervals on the network connection, and producing a small graph (60 pixels wide) showing the network traffic. I then noticed that traffic was still getting through at a rate of 40 bytes/sec on the now "disconnected" wired connection.

I then did a few tests, and found:
- for some reason there is also the option of "Disabling" the network on the applet.
- both "Disconnect" and "Disable" produce the same message "Disconnected - you are now offline".
- "Disconnecting" the wired connection, with the network "Enabled" still allows slow traffic through, however browsing the Internet and downloading is not possible.
- "Disabling" the network, without disconnecting the connection, stops all traffic.

This is a security flaw, since "Disconnecting" the LAN should have the same effect as unplugging the LAN cable from the network port, thus not allowing any traffic to get through.

The attached screenshots show that for a period of 2 minutes 45 seconds, my PC have received 109 packets (6.4 kB) and sent 2 packets (0.2 kB), while being "disconnected".

When clicking on the network applet icon, I see the following lines/options:

Wired network
Wired connection 1
Disconnect

VPN connections
Enable Networking (Checked)
Connection Information
Edit Connections

I suspect that the disconnect/disable anomaly is the result of installing Gnome3 over Unity.

[Seth Arnold (seth-arnold)]

Is network-manager-applet the correct destination?

What is the expected difference between "disconnect" and "disable"?

[Dawie Steynfaard (dawies)]

1) Yes, the network-manager-applet is the correct destination.

2) I don't know what the intended difference between "disconnect" and "disable" is supposed to be, however I expect that both should result in a total isolation from the network.

I therefore recommend that "disconnect" be removed from the drop-down menu of the network-manager-applet, since it duplicates the outcome of "disable", and does not work correctly anyway (allows slow traffic to pass through).

[Marc Deslauriers (mdeslaur)]

"Disconnect" simply releases the DHCP address on the Interface. The network card is still active, and can still receive and transmit packets.

"Disable" actually downs the network interface.

Please file a bug with the upstream network-manager project and link it here if you don't agree with this terminology:

https://bugzilla.gnome.org/browse.cgi?product=NetworkManager

Thanks!

[Dawie Steynfaard (dawies)]

Thanks,

I filed a bug report, recommending that the terminology be adapted:

https://bugzilla.gnome.org/show_bug.cgi?id=691722