So I was poking around with netstat and ran:

One particular connection was very odd:

Anyone know why there would be an open connection to my ISP via gvfsd-http over some random local port?

According to this article, gvfs is a way to establish remote connections and browse file systems / access data remotely as if they are your own. Am I being paranoid here? Is there some benign, legitimate reason for this connection to exist? Is it just some normal connection that is going through my ISP because, well... they are my ISP and that's where connections go... or something else?

If it isn't painfully obvious by now - I am completely ignorant about networking and security. Just trying to figure it out as I go and educate myself. Google wasn't much help with terms like "gvfs connections", "gvfsd-http connection" etc... just people having problems with rhythmbox or the known bug of connections being left in the CLOSE_WAIT state for longer than usual, etc.

Thanks!

OK, if you bought MindGuard then I'd be wondering but being curious about inner workings doesn't necessarily mean you're paranoid. GVFS in this case handles virtual network file system access for applications ranging from Rhythmbox using last.fm plugin or fetching album art to the update manager sharing collected statistics. The reason why it's going through your ISP's servers may be due to local proxy settings. If you want to find out what's actually being sent you could capture traffic with say Wireshark and look at the payload.

Thanks for the reply! Looking into wireshark now, looks like I can grab it with apt. Will dig around and see what I can find.