I am using Ubuntu 17.10 on my desktop PC, I've been monitoring network traffic with Etherape. I noticed HTTP requests from my PC(casa hostname) to googleusercontent.com (104.198.143.177).  

So I used `lsof` and `ss` to 'identify' process behind these requests. 

Using `lsof -i`: 

```
NetworkMa  778            root   20u  IPv4 546772      0t0  TCP casa:53671->177.143.198.104.bc.googleusercontent.com:http (SYN_SENT)
NetworkMa  778            root   20u  IPv4 546772      0t0  TCP casa:53671->177.143.198.104.bc.googleusercontent.com:http (ESTABLISHED)

```

Using `ss -rep dst 104.198.143.177`: 

```
tcp    SYN-SENT   0      1      casa%enp4s0:53671    177.143.198.104.bc.googleusercontent.com:http  users:(("NetworkManager",pid=778,fd=20)) timer:(on,964ms,0) ino:546772 sk:6df <->
tcp    ESTAB      0      87     casa%enp4s0:53671    177.143.198.104.bc.googleusercontent.com:http  users:(("NetworkManager",pid=778,fd=20)) timer:(on,300ms,0) ino:546772 sk:6df <->

```

It seems NetworkManager (pid 778) is sending requests to googleusercontent, and it happens **every 5 minutes** exactly. 

I have to say, no applications were launched at the moment, no background process, no network activities,no online account and it was a 'Ubuntu fresh install'.  

So why NM would sent requests to googleusercontent?