Running wireshark while starting the IDE, I can see a load of network traffic coming from arduino.
Notably contacting amazon webservices, must be the host for arduino.cc. Trying to compare the network traffic from 1.6.13 and 1.6.11 to see the difference.
Strange that if there is no response from the servers the IDE works.