I have a Raspberry Pi (Raspbian/Debian Bullseye) that's set up with a cellular modem as its only internet-connected network interface. To reduce data costs, I want to restrict Raspbian's network usage to only my app. Letting it run for a few days with nethogs inspecting network usage, it seems like something is triggering automatic apt updates, consuming around 30KB/day.
I've already disabled and masked apt-daily.service, apt-daily-upgrade.service, apt-daily.timer, and apt-daily-upgrade.timer. cat /var/log/syslog | grep apt is empty, and /var/log/apt/*.log show no activity.
Given the total payload size, it's definitely doing apt update in the background, because I can trigger the exact same network footprint with sudo apt update manually. How can I find out what's triggering it?
unattended-upgradesis not installedsudo grep -i 'apt.*update' /etc/crontab /etc/cron*/* /var/spool/cron/crontabs/*