Portmaster is mandatory nowadays, like also InviZible Pro in Android

Yeah, * Tor. Its primary job is to make and destroy tons of connections to keep you private.

Edit: Still getting used to FUTO keyboard. It doesn't need me to say comma

Tor creates a ton of connections to all kinds of places, so that might have been the source.

it sounds like you'll need a better handle on what's running on your computer.

if this matters to you enough: you can start with pruning the systemd services that are running to remove the ones you don't want so that you can know for certain what is supposed to be running and then run another capture to see where it's calling out to.

Per its nature, tor is definitely going to create a lot of noise in your capture. Shut it down and try again, see if you still have so many connections.

It is highly unlikely that you have malware that you can't see, so if you still see them after shutting down tor, use tools that tell you which app has established connections.

Socket shark, maybe? The repeating 2 digit namespace is valuable enough that there was no way ss was going unused, nazi-association be damned

i only have these over long term but brave was closed when recording:

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp ESTAB 0 0 192.168.1.100%wlan0:68 192.168.1.1:67 users:(("NetworkManager",pid=1065,fd=27))
tcp ESTAB 0 0 192.168.1.100:57728 185.246.86.175:9001 users:(("tor",pid=1143,fd=16))
tcp ESTAB 0 0 192.168.1.100:60406 54.36.178.108:443 users:(("brave",pid=5153,fd=27))
tcp ESTAB 0 0 192.168.1.100:40606 89.58.56.112:587 users:(("tor",pid=1143,fd=12))

If it's like a vpn interface, it's still running as a deamon in the background even if the browsers are closed.

Like others have said you can check what application is using each open port. You can also check running processes (ps | grep keywords) and interfaces (ip a).

Everything has a reason