as i said, the installation is native and fresh. also, i have removed all useless services, such as avahi*, unattended-upgrades, etc. only ssh and ntp are running. so my question: where are the canonical and other undefined connection attempts coming from?? where can i find the responsible code in the system?