[Mac] Constant low-bandwidth steam of network activity

[Schmye Bubbula]

As long as Firefox is running, even without any windows open, I experience a steady stream of network activity. It's both upstream & downstream, low bandwidth—typically 2.2 kB/s upstream & 1.4 kB/s downstream. I can't find where it's coming from, and how to turn it off. It's there if I launch in Safe Mode, so that rules out all my Add-ons, right? And it's there if I disable all telemetry, Health Report, etc. in Preferences > Advanced > Data Choices. I don't see any other preferences that might cause it. It stops if I do File > Work Offline, but promptly returns when I resume. However, if I launch Firefox from another, newly-created profile, the network activity isn't there. Can somebody suggest what I'm overlooking? I'm sure it's very simple. Thanks!

[Mark12547]

Do you also have Sync turned off (on Options -> Sync, never set up Sync or completely logged out of Sync)?

[Schmye Bubbula]

^ Thanks, forgot to mention that I don't have Sync enabled, and don't even have an account.

[8-bit]

However, if I launch Firefox from another, newly-created profile, the network activity isn't there.

I am assuming you have manually set all prefs in the new fresh profile, correct? - or is it just a clean profile with no tweaking whatsoever?

[Schmye Bubbula]

^ A newly-created profile, a clean profile with no tweaking whatsoever.

I also don't get this low-level networking activity from my troubleshooting profile, where surely I've manually set some prefs, but I don't remember what they are off the top of my head.

[8-bit]

Just out of curiosity (I know you have launched in safe mode which disables them), what add-ons do you have installed?

[therube]

(I know nothing of Mac.
How does FF "run" if no windows are open?)

Where is this network activity going to (IP's)?
Is it actually going out into the Internet or is it just local activity?

Does FF talk to "localhost" (for IPC reasons or whatever) on Mac?
Is there an antivirus in the picture interfering, with FF "communication" being run through A/V?

[8-bit]

(I know nothing of Mac.
How does FF "run" if no windows are open?)

On a Mac, you can close the browser window, but Firefox remains active and running (albeit using very little resources). The program does not shut down if you close the browser window. macOS is basically UNIX with a GUI (an oversimplification, but a sufficient short answer)

Also, to the OP - You are running Snow Leopard which is nearing 7 generations behind the current macOS, and also an older version of Firefox (which is probably for compatibility reasons with SL and your machine). That makes it harder to trouble shoot this.

I would just export my bookmarks, re-install Firefox & set prefs, re-import bookmarks, and then re-install your add-ons (that's why I asked what add-ons you use as this will be more difficult if your add-ons have lots of data stored and there is no way to export/import it)

[Schmye Bubbula]

Just out of curiosity (I know you have launched in safe mode which disables them), what add-ons do you have installed?

- about:addons-memory 12
- AdBlocker for Facebook™ 0.1.8
- Add-ons Manager Context Menu 0.4.2.1-signed.1-signed
- Addons Manager Hilite 3.0
- Advanced Tab Navigation 1.1.2
- BetterPrivacy 1.74
- Bloody Vikings! 0.8.6
- BugMeNot Plugin 3.1-signed.1-signed
- Cache Disabler 1.2.0
- Classic Theme Restorer 1.7.0
- Clearly 10.2.1.7.1-signed
- Color Management 0.5.3.1-signed.1-signed
- Cookies Manager+ 1.14.3
- DblClicker 1.8.1
- Decentraleyes 1.3.10
- Disable WebRTC 1.0.16
- Disconnect 5.18.21
- Dm0nKs Spotify Link Redirector 1.0.rev39.1-signed.1-signed
- Docs Online Viewer 5.5.5
- Extension List Dumper 2 1.0.2
- Extension Options Menu 2.18
- external IP 0.9.9.6.1-signed
- Firefox Hello 1.4.4
- Flash Video Downloader - YouTube HD Download [4K] 13.2.4
- FlashStopper 1.4.5
- FoxBleed 0.1.1-signed.1-signed
- Go Parent Folder 2.9.1.1-signed.1-signed
- Greasemonkey 3.11
- History Submenus II 4.0.4
- HTTPS Everywhere 5.2.21
- ImageShack right-click 1.0.1.1-signed.1-signed
- MEGA 3.15.6
- Multi-process staged rollout 1.1
- Multirow Bookmarks Toolbar Plus 1.10
- NoScript 5.0.10rc4
- NoSquint Plus 54.0
- Open Download Manager on Download 0.1.1-signed.1-signed
- Pocket 1.0.4
- Precise Clear History 1.3.1-signed.1-signed
- Preserve Download Modification Timestamp 2011.03.21.22.1-signed.1-signed
- ProfileSwitcher 1.7.6.1
- RAMBack 1.0.1-signed.1-signed
- Remove Visited Link 0.3.2
- Remove/Crop-to Selection 0.2
- Saved Password Editor 2.10.3
- Show me the password 1.1.1.1-signed.1-signed
- Show Parent Folder 2.1.1
- Slim Add-ons Manager 14.1
- SocialReviver 4.4.9
- Space Next 0.34.1-signed.1-signed
- Status-4-Evar 2017.08.20.15
- Strict Pop-up Blocker 0.3
- Thumbnail Zoom Plus 4.2
- TinEye Reverse Image Search 1.2.2
- Twitter Side Switcher 1.0.4.1.1-signed.1-signed
- uBlock Origin 1.13.8
- User Agent Switcher 0.7.3.1-signed.1-signed
- X-notifier 3.5.23
- YouTube High Definition 52.0.7

(I know nothing of Mac.
How does FF "run" if no windows are open?)

You can close the last window in Mac apps, and the app still runs. Then you can open a new window if you wish. (The menu bar is not in the window, but instead at the top of the screen, and when you switch apps, the menu bar changes to the new app's menu bar.)

Where is this network activity going to (IP's)?
Is it actually going out into the Internet or is it just local activity?... Does FF talk to "localhost" (for IPC reasons or whatever) on Mac?

According to my Little Snitch Network Monitor, Firefox is connected to 674 (!!) servers. I'd have to do a little work to be able to tell you some of the IP addresses, but we're definitely not talking localhost here.

Is there an antivirus in the picture interfering, with FF "communication" being run through A/V?

No antivirus scanner running.

[Schmye Bubbula]

I have my reasons for being in Snow Leopard.... I was just hoping that someone has had this low-level network activity in otherwise idle Firefox occur for them, and possibly a quick answer, "Oh, that's happened to me—it was..."

[8-bit]

According to my Little Snitch Network Monitor, Firefox is connected to 674 (!!) servers. I'd have to do a little work to be able to tell you some of the IP addresses, but we're definitely not talking localhost here.

That's a lot of add-ons

Many overlap in functionality, but I won't go into this... I only use 4!

I would venture to guess Firefox being connected to 674(!) servers may have something to do with it, but, as you explained in your original post you can get it to stop with a fresh profile. Although it still does it in safe mode so that should be a red flag of some sort.

As stated previously, on September 25th you will officially be 7 generations behind in macOS (probably due to some of the programs you need to run), and are using an older version of Firefox (for obvious compatibility reasons with your machine & OS.) Also, using a version of Firefox that is soon to be 8 generations old is not good from a security standpoint.

Dunno. I hate to leave you out in the cold, but with all those connections, it's impossible for me to continue to help in a forum environment.

[Schmye Bubbula]

Correction: I launched Firefox into my nearly pristine troubleshooting profile, and Little Snitch Network Monitor still showed Firefox connected to over 600 servers, even though the Firefox network activity stops. So that figure must be a cumulative number for the login session, not the current number of servers to which Firefox is connected. Sorry for the confusion.... Is there an easy way to determine the IP address(es) involved in this constant low-level network stream into & out of Firefox? Is there an Add-on extension for that?

[Grumpus]

If Mac has an IP traffic monitor add-on you might be able to see some of the traffic. (Possibly in the system monitor)
It would depend on what kind of traffic (UDP or TCP), it would have to monitor both.
I had a similar stream a while back and found it was from the wireless ISP and not from Firefox or the system.
A call to the ISP resolved it.

[Schmye Bubbula]

^ My aforementioned Little Snitch Network Monitor lets you select "Firefox" in its window and see the network streams exclusively in & out of Firefox, so I can rule-out wireless ISP, the system, and everything else.

While looking around in that Little Snitch Network Monitor window, I discovered that the contextual menu (right-click) for the Firefox entry had a Capture Traffic of "Firefox..., so I did so, and it saves it as a .pcap file. When I double-clicked it, it opened in Cocoa Packet Analyzer (a poor man's Wireshark), and inasmuch as my Little Snitch Network Monitor window showed activity several times a second, I need only quote a small sample—two seconds—of the capture:

Code: Select all

Id = 1
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 243
Packet Length = 243
Protocol = TCP
Information = 443 -> 24171 ([ACK], Seq=0, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0
Id = 2
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24171 -> 443 ([ACK], Seq=0, Ack=189, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0
Id = 3
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 138
Packet Length = 138
Protocol = TCP
Information = 24171 -> 443 ([ACK], Seq=0, Ack=189, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 2.09808349609375e-05
Id = 4
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24171 ([ACK], Seq=189, Ack=84, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 2.09808349609375e-05
Id = 5
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 264
Packet Length = 264
Protocol = TCP
Information = 443 -> 24171 ([ACK], Seq=189, Ack=84, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 3.600120544433594e-05
Id = 6
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24171 -> 443 ([ACK], Seq=84, Ack=399, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 3.600120544433594e-05
Id = 7
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 85
Packet Length = 85
Protocol = TCP
Information = 443 -> 24141 ([ACK], Seq=0, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.02360916137695312
Id = 8
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24141 -> 443 ([ACK], Seq=0, Ack=31, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.02360916137695312
Id = 9
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24141 -> 443 ([ACK, FIN], Seq=0, Ack=31, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.02413105964660645
Id = 10
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24141 ([ACK, FIN], Seq=31, Ack=1, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.02413105964660645
Id = 11
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24141 -> 443 ([ACK], Seq=1, Ack=32, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.02413105964660645
Id = 12
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24173 -> 443 ([SYN], Seq=1671067660, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.05342698097229004
Id = 13
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24173 ([ACK, SYN], Seq=192713458, Ack=1671067661, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.05342698097229004
Id = 14
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671067661, Ack=192713459, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.05342698097229004
Id = 15
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 281
Packet Length = 281
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671067661, Ack=192713459, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.0543360710144043
Id = 16
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713459, Ack=1671067888, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.0543360710144043
Id = 17
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 199
Packet Length = 199
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713459, Ack=1671067888, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.1642119884490967
Id = 18
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671067888, Ack=192713604, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.1642119884490967
Id = 19
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 105
Packet Length = 105
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671067888, Ack=192713604, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.164553165435791
Id = 20
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713604, Ack=1671067939, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.164553165435791
Id = 21
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 678
Packet Length = 678
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671067939, Ack=192713604, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.1647579669952393
Id = 22
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713604, Ack=1671068563, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.1647579669952393
Id = 23
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 243
Packet Length = 243
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713604, Ack=1671068563, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.273827075958252
Id = 24
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671068563, Ack=192713793, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.273827075958252
Id = 25
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 138
Packet Length = 138
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671068563, Ack=192713793, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.283311128616333
Id = 26
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713793, Ack=1671068647, Win=65535)
Date Received = 2017-09-14 12:34:05 -0400
Time Delta = 0.283311128616333
Id = 27
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 264
Packet Length = 264
Protocol = TCP
Information = 443 -> 24173 ([ACK], Seq=192713793, Ack=1671068647, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.3878331184387207
Id = 28
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24173 -> 443 ([ACK], Seq=1671068647, Ack=192714003, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.3878331184387207
Id = 29
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 85
Packet Length = 85
Protocol = TCP
Information = 443 -> 24142 ([ACK], Seq=0, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.4827711582183838
Id = 30
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24142 -> 443 ([ACK], Seq=0, Ack=31, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.4827711582183838
Id = 31
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24142 -> 443 ([ACK, FIN], Seq=0, Ack=31, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.4834139347076416
Id = 32
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24142 ([ACK, FIN], Seq=31, Ack=1, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.4834139347076416
Id = 33
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24142 -> 443 ([ACK], Seq=1, Ack=32, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.4834139347076416
Id = 34
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24175 -> 443 ([SYN], Seq=1561006484, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.5026910305023193
Id = 35
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24175 ([ACK, SYN], Seq=2133626771, Ack=1561006485, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.5026910305023193
Id = 36
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561006485, Ack=2133626772, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.5026910305023193
Id = 37
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 281
Packet Length = 281
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561006485, Ack=2133626772, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.5034420490264893
Id = 38
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133626772, Ack=1561006712, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.5034420490264893
Id = 39
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 199
Packet Length = 199
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133626772, Ack=1561006712, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.6116950511932373
Id = 40
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561006712, Ack=2133626917, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.6116950511932373
Id = 41
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 105
Packet Length = 105
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561006712, Ack=2133626917, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.6122291088104248
Id = 42
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133626917, Ack=1561006763, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.6122291088104248
Id = 43
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 678
Packet Length = 678
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561006763, Ack=2133626917, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.6125810146331787
Id = 44
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133626917, Ack=1561007387, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.6125810146331787
Id = 45
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 243
Packet Length = 243
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133626917, Ack=1561007387, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.7215001583099365
Id = 46
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561007387, Ack=2133627106, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.7215001583099365
Id = 47
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 138
Packet Length = 138
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561007387, Ack=2133627106, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.7289750576019287
Id = 48
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133627106, Ack=1561007471, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.7289750576019287
Id = 49
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 264
Packet Length = 264
Protocol = TCP
Information = 443 -> 24175 ([ACK], Seq=2133627106, Ack=1561007471, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.8390400409698486
Id = 50
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24175 -> 443 ([ACK], Seq=1561007471, Ack=2133627316, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.8390400409698486
Id = 51
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 85
Packet Length = 85
Protocol = TCP
Information = 443 -> 24143 ([ACK], Seq=0, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9381840229034424
Id = 52
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24143 -> 443 ([ACK], Seq=0, Ack=31, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9381840229034424
Id = 53
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24143 -> 443 ([ACK, FIN], Seq=0, Ack=31, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9389500617980957
Id = 54
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24143 ([ACK, FIN], Seq=31, Ack=1, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9389500617980957
Id = 55
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24143 -> 443 ([ACK], Seq=1, Ack=32, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9389500617980957
Id = 56
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24176 -> 443 ([SYN], Seq=1059789835, Ack=0, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9531800746917725
Id = 57
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24176 ([ACK, SYN], Seq=139536873, Ack=1059789836, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9531800746917725
Id = 58
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059789836, Ack=139536874, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9531800746917725
Id = 59
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 281
Packet Length = 281
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059789836, Ack=139536874, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9539170265197754
Id = 60
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139536874, Ack=1059790063, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 0.9539170265197754
Id = 61
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 199
Packet Length = 199
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139536874, Ack=1059790063, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.063392162322998
Id = 62
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059790063, Ack=139537019, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.063392162322998
Id = 63
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 105
Packet Length = 105
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059790063, Ack=139537019, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.064520120620728
Id = 64
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139537019, Ack=1059790114, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.064520120620728
Id = 65
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 678
Packet Length = 678
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059790114, Ack=139537019, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.064535140991211
Id = 66
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139537019, Ack=1059790738, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.064535140991211
Id = 67
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 243
Packet Length = 243
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139537019, Ack=1059790738, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.179753065109253
Id = 68
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059790738, Ack=139537208, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.179753065109253
Id = 69
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 138
Packet Length = 138
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059790738, Ack=139537208, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.190397977828979
Id = 70
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139537208, Ack=1059790822, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.190397977828979
Id = 71
Source = 54.200.193.191
Destination = 0.0.170.207
Captured Length = 264
Packet Length = 264
Protocol = TCP
Information = 443 -> 24176 ([ACK], Seq=139537208, Ack=1059790822, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.298731088638306
Id = 72
Source = 0.0.170.207
Destination = 54.200.193.191
Captured Length = 54
Packet Length = 54
Protocol = TCP
Information = 24176 -> 443 ([ACK], Seq=1059790822, Ack=139537418, Win=65535)
Date Received = 2017-09-14 12:34:06 -0400
Time Delta = 1.298731088638306

Plugging the two IP addresses (alternating as Source and Destination) into the IPLocationTools website, one of them, 0.0.170.207, is my Time-Warner ISP, and the other, 54.200.193.191, is amazon.com Data Center/Web Hosting/Transit.

Well, that's a good lead! Anyone have any idea what Amazon at some point put into my default Firefox profile that seems to be able to get around a Safe Mode launch? Surely I'm not the only one this has happened to.

[Grumpus]

If you allowed any of the Mozilla data transfer permissions like health report, crash, additional data like telemetry or other.
Might also be automatic updates of search engines or extensions if that is allowed.
It could also be any number of other things since Amazon does not tell what or who it is actually for or what it is too/from.