Re: mysterious/suspicious internet activity.

[Samuel Sieb]

On 12/2/20 3:06 PM, Tim via users wrote:
> All normal stuff, although they're listening to any address, rather
> than only listening to local addresses.  That could be tightened up for
> some things, at least.  I see no reason for CUPS to listen outside of
> your LAN, for instance.

I assume you're referring to the lines like this:
tcp        0      0 0.0.0.0:ipp             0.0.0.0:* 
LISTEN      root       22447      947/cupsd

That foreign address is just a placeholder. Nothing is actually 
connected.  The process is listening for a connection and will accept 
one from anywhere.  It's up to the firewall to restrict that.