traffic towards port 6881

Post your questions about BT download, FTP download, HTTP download, or QGet download software here.
droopy
Starting out
Posts: 18
Joined: Tue Nov 06, 2007 3:01 am

traffic towards port 6881

Postby droopy » Mon Jun 07, 2010 11:47 pm

Hi,

With a disabled downloadstation and no other torrent application installed I still see a lot of external traffic coming in on port 6881. Anybody a clue what this could be?
QNAP TS-419P
3 * WDC WD20EFRX 2TB
4.1.0 Build 0612

justinatomatic
New here
Posts: 2
Joined: Wed Apr 13, 2011 7:35 am

Re: traffic towards port 6881

Postby justinatomatic » Wed Apr 13, 2011 7:53 am

I had download station enabled but have never used it or loaded a torrent and I still get a tone of UDP traffic on port 6881 and outgoing traffic to machines all over the world.

"59","1.565954","192.168.0.2","112.156.19.192","UDP","Source port: 6881 Destination port: 63023"
"60","1.605960","46.0.46.160","192.168.0.2","UDP","Source port: 41307 Destination port: 6881"
"61","1.607234","192.168.0.2","187.39.199.113","UDP","Source port: 6881 Destination port: 52170"
"62","1.620024","82.1.235.66","192.168.0.2","UDP","Source port: 50277 Destination port: 6881"
"63","1.621208","192.168.0.2","83.28.160.236","UDP","Source port: 6881 Destination port: 51936"

I've since disabled downloadstation and increased my security settings. I'm still getting the same amount of incoming traffic. I'm also still getting outgoing traffic but now its at least getting ICMP errors.

"60","3.236236","192.168.0.2","46.249.0.124","ICMP","Destination unreachable (Port unreachable)"
"61","3.281731","82.17.163.201","192.168.0.2","UDP","Source port: 26796 Destination port: 6881"
"62","3.281811","192.168.0.2","82.17.163.201","ICMP","Destination unreachable (Port unreachable)"
"63","3.858085","178.156.72.128","192.168.0.2","UDP","Source port: 10026 Destination port: 6881"
"64","3.858089","192.168.0.2","178.156.72.128","ICMP","Destination unreachable (Port unreachable)"
"65","4.172768","89.122.156.56","192.168.0.2","UDP","Source port: 14401 Destination port: 6881"
"66","4.172772","192.168.0.2","89.122.156.56","ICMP","Destination unreachable (Port unreachable)"

Its seems that despite disabling downloadstation some process on the QNAP is still attempting to generate bittorrent trafic

Hammond
Starting out
Posts: 29
Joined: Mon May 17, 2010 6:19 pm

Re: traffic towards port 6881

Postby Hammond » Fri Apr 15, 2011 12:10 am

I just bought a netgear hub (GS105E) that has port mirroring so that I can see what traffic comes and goes from my QNAP NAS.
SHOCK AND HORROR...!!!!
It seems with NO torrents or any other form of download in the 'Download Station' the QNAP holds open tons of connections to the outside world.
(Every part of 'Download Station' been checked for a hidden file that may be listed or loaded or anything else - nothing)
Loads of traffic is coming and going. Mostly UDP port 6881 and a mix of other random port numbers.
At any one time it seems like there is at least 50 to 100 simultaneous connections happening to every country known to man.

WHAT IS GOING ON??

Example of a packet:

INBOUND:
0x0000 00 08 9B C3 FB 96 00 22-3F D3 10 AE 08 00 45 00 ..›Ãû–."?Ó.®..E.
0x0010 01 2F 1D 70 40 00 77 11-6F 56 46 1F 24 DD 0A 00 ./.p@.w.oVF.$Ý..
0x0020 00 FC B3 51 1A E1 01 1B-14 10 64 31 3A 72 64 32 .ü³Q.á....d1:rd2
0x0030 3A 69 64 32 30 3A 53 88-9C 14 F7 25 24 0C 4E DE :id20:Sˆœ.÷%$.NÞ
0x0040 E3 CF B7 A4 16 42 F8 BD-E4 7D 35 3A 6E 6F 64 65 ãÏ·¤.Bø½ä}5:node
0x0050 73 32 30 38 3A 53 06 B4-82 01 7C 18 50 F1 E1 8C s208:S.´‚.|.PñáŒ
0x0060 48 4B 4B 21 4A 40 BB 28-73 6D 79 DD 5B 5F F2 53 HKK!J@»(smyÝ[_òS
0x0070 15 5C 11 BF 02 48 75 5D-09 C5 83 E5 9D CF 59 D0 .\.¿.Hu].ŃåÏYÐ
0x0080 D9 62 0D 2E 81 11 DF 13-79 53 19 57 AA 69 E6 EB Ùb...ß.yS.Wªiæë
0x0090 5E 64 7D 45 37 5D EA DC-EC 16 F8 D6 DC 51 6D 45 ^d}E7]êÜì.øÖÜQmE
0x00A0 6A FB C7 53 37 3D 85 53-E8 59 E8 43 0C 57 EF 6E jûÇS7=…SèYèC.Wïn
0x00B0 0E 0A EE 64 8F 9B 3F 3A-BE 2D B6 33 1B 53 4A 93 ..îd›?:¾-¶3.SJ“
0x00C0 9D 7B E2 D9 DA D9 C8 66-BB E1 F3 61 9A 13 2F 72 {âÙÚÙÈf»áóaš./r
0x00D0 51 18 D3 7E 48 5C 7D 53-64 F5 62 6E 43 0B 4F 5A Q.Ó~H\}SdõbnC.OZ
0x00E0 9E D6 95 D3 97 06 F6 20-A3 4A 33 72 2D 3F 3B 48 žÖ•Ó—.ö £J3r-?;H
0x00F0 1A 53 72 01 85 95 FF 9E-1C C6 C9 6D 6C D9 C6 15 .Sr.…•ÿž.ÆÉmlÙÆ.
0x0100 D3 C4 E3 63 3C 3D 5C 2E-48 26 91 53 7F 58 D2 4D ÓÄãc<=\.H&‘SXÒM
0x0110 33 EE 34 CF A2 41 DC 80-E4 BC 87 F0 BE A6 7D 5F 3î4Ï¢A܀伇ð¾¦}_
0x0120 84 A1 D5 52 5B 65 31 3A-74 32 3A 02 D0 31 3A 76 „¡ÕR[e1:t2:.Ð1:v
0x0130 34 3A 55 54 54 52 31 3A-79 31 3A 72 65 4:UTTR1:y1:re

OUTBOUND:
0x0000 00 22 3F D3 10 AE 00 08-9B C3 FB 96 08 00 45 00 ."?Ó.®..›Ãû–..E.
0x0010 00 81 00 00 40 00 40 11-C4 7B 0A 00 00 FC B4 5E ...@.@.Ä{...ü´^
0x0020 B6 96 1A E1 AF 6A 00 6D-C8 71 64 31 3A 61 64 32 ¶–.á¯j.mÈqd1:ad2
0x0030 3A 69 64 32 30 3A 6E 58-3C 82 95 A9 32 EA A9 BE :id20:nX<‚•©2ꩾ
0x0040 BB 0A 1B DD 6B EF AB E9-32 5C 36 3A 74 61 72 67 »..Ýkï«é2\6:targ
0x0050 65 74 32 30 3A BF 0B B3-32 E0 94 01 35 57 A1 EE et20:¿.³2à”.5W¡î
0x0060 56 F5 70 F4 F1 9B 1C 47-88 65 31 3A 71 39 3A 66 Võpôñ›.Gˆe1:q9:f
0x0070 69 6E 64 5F 6E 6F 64 65-31 3A 74 32 3A 02 8D 31 ind_node1:t2:.1
0x0080 3A 76 34 3A 4C 54 00 0E-31 3A 79 31 3A 71 65 :v4:LT..1:y1:qe

andbir
Know my way around
Posts: 141
Joined: Wed Oct 22, 2008 2:34 am
Location: Lund Sweden
Contact:

Re: traffic towards port 6881

Postby andbir » Fri Apr 15, 2011 3:21 am

This is probably "the internet" happening to you. i.e. some hackers, some hijacked machines and some various media industry and attorney companies and computer firms helping either the media industry or its' attorneys find whoever is file-sharing or torrenting.

After all, anybody on the internet can send anything to anybody, as long as you have your ports open in your firewall i am sure someone will try to send something to you at some point in time, just to see what happens... After all you are connected to "everybody" so chances are that "somebody" will eventually knock on your door to see what happens.
Andreas Birgerson
Medical Doctor (resident) and DJ
Lund, Sweden

TS-509 pro (4gb ram) 5x2tb RAID5
TVS-1282-i5-16gb; 5x10tb HGST RAID5

justinatomatic
New here
Posts: 2
Joined: Wed Apr 13, 2011 7:35 am

Re: traffic towards port 6881

Postby justinatomatic » Fri Apr 15, 2011 8:23 am

I turned off Downloadstation and set the security setting to high and including only my local IP range. While initialy the traffic was still there it died off after a few hours. Came home from work and the constant traffic is gone. Have't actually had chance to check with Wireshark but it looks like its fixed.

User avatar
schumaku
Guru
Posts: 42254
Joined: Mon Jan 21, 2008 4:41 pm
Location: Kloten (Zurich), Switzerland -- Skype: schumaku
Contact:

Re: traffic towards port 6881

Postby schumaku » Fri Apr 15, 2011 10:10 pm

All,

Nothing scary: The BitTorrent DHT (Distributed Hash Table) is by default on 6881/UDP. It allows the tracker-less operation of the BitTorrent network...

FMI: Google bittorrent dht trackerless

-Kurt.

Hammond
Starting out
Posts: 29
Joined: Mon May 17, 2010 6:19 pm

Re: traffic towards port 6881

Postby Hammond » Sat Apr 16, 2011 12:39 am

Well it is scary when you see a ton of connections to your file server and wonder what is going on!
Assuming Kurt is right and it is just DHT that runs even when no torrents are in progress this is something they should have a warning or on/off switch for.
I can totally understand while the server is busy downloading a torrent but when its idle I don't want it to be a fat node using all of my modems connection threads.
For the record my firewall has no port forwarding on for any those ports and UPNP is off too. Yet it still holds those connections open.. thats also not cool.
When 'download station' is off completely all connections are broken within a few minutes which proves it is only 'download station' and nothing else.

User avatar
schumaku
Guru
Posts: 42254
Joined: Mon Jan 21, 2008 4:41 pm
Location: Kloten (Zurich), Switzerland -- Skype: schumaku
Contact:

Re: traffic towards port 6881

Postby schumaku » Sat Apr 16, 2011 2:30 am

Hammond wrote:Well it is scary when you see a ton of connections to your file server and wonder what is going on!
The majority of BitTorrent users has no clue what's going on behind - no matter if it's on a Mac, a Windows, a Linux system - or a NAS.

Hammond wrote:Assuming Kurt is right and it is just DHT that runs even when no torrents are in progress this is something they should have a warning or on/off switch for.
Well, first you should be aware that DHT is key to come away from the tracker based torrent files. In the not so far future, you will only see Magnet Links - directly searchable in the DHT - and no more torrent files. to bad,, QNAP has not opened the option to make use of Magnet Links in the new Download Station yet.

Hammond wrote:I can totally understand while the server is busy downloading a torrent but when its idle I don't want it to be a fat node using all of my modems connection threads.
Well, that's the future already here today. Are you making use of Skype - and have ever checked the connections?!?

Hammond wrote:For the record my firewall has no port forwarding on for any those ports and UPNP is off too. Yet it still holds those connections open.. thats also not cool.
We can't balme QNAP for that! Forget the crappy consumer router and wanabe-firewall boxes - real firewalls don't allow this kind of traffic.

Hammond wrote:When 'download station' is off completely all connections are broken within a few minutes which proves it is only 'download station' and nothing else.
If that's an attempt to explain that the data you spotted really DHT traffic ... so I was not that wrong.

Now, congratulation for your discovery: I bet that only one of 1'000 users here in the forum (on the global BT userbase much less!) do recognize what is going on under the hood of BItTorrent - 1 Mio. users will be happy that it works, and a hand ful is wondering...

However - it's time to bash your own ears. Of course, there is a control for the DHT functionality:

bt_connection.PNG


Enjoy,
-Kurt.
You do not have the required permissions to view the files attached to this post.

User avatar
Dr Strangelove
Getting the hang of things
Posts: 82
Joined: Thu Aug 04, 2011 8:42 am

Re: traffic towards port 6881

Postby Dr Strangelove » Tue Sep 03, 2013 10:38 pm

schumaku wrote:Now, congratulation for your discovery: I bet that only one of 1'000 users here in the forum (on the global BT userbase much less!) do recognize what is going on under the hood of BItTorrent - 1 Mio. users will be happy that it works, and a hand ful is wondering...

-Kurt.


Model: TS-112
Current firmware version: 3.8.3 Build 20130426

1001 now :DD

Took a bit of sleuthing.

Blocked Protocol and Port access to some VPN IP addresses on a modem and then started seeing Port 6881 ... China, Russian, Ukraine...Oh **!!! :-0

Just happy there was a reason. Disabled now. :)

Thanks Kurt.

microsaft
First post
Posts: 1
Joined: Thu Jun 24, 2010 1:57 am

Re: traffic towards port 6881

Postby microsaft » Fri Sep 12, 2014 3:33 am

This happened to me aswell as soon as (or a bit later) when i enabled qnap download station. I also do not have the port forwarding enabled for 6881 but still the connections open thru the firewall and end up reaching the nas endpoint.
I do not like this behaviour and disabled download station again for this reason. if i need it i will enable it just for the moment and disable again.

User avatar
schumaku
Guru
Posts: 42254
Joined: Mon Jan 21, 2008 4:41 pm
Location: Kloten (Zurich), Switzerland -- Skype: schumaku
Contact:

Re: traffic towards port 6881

Postby schumaku » Fri Sep 12, 2014 3:54 am

microsaft wrote:I also do not have the port forwarding enabled for 6881 but still the connections open thru the firewall and end up reaching the nas endpoint.
Without the port forwarding configured manually, and without the "Enabled UPnP Port Mapping", ...
- new incoming DHT connections can't be established (DHT can be disabled if you don't want understand the advantages for the BT community)
- then, to run BitTorrent, the other port range must be forwarded (as configured), otherwise downloads will be massively slowed down.

Nothing wrong with both kind of access attempts.

User avatar
pwilson
Guru
Posts: 22589
Joined: Fri Mar 06, 2009 11:20 am
Location: Victoria, BC, Canada (UTC-08:00)

Re: traffic towards port 6881

Postby pwilson » Fri Sep 12, 2014 4:17 am

microsaft wrote:This happened to me aswell as soon as (or a bit later) when i enabled qnap download station. I also do not have the port forwarding enabled for 6881 but still the connections open thru the firewall and end up reaching the nas endpoint.
I do not like this behaviour and disabled download station again for this reason. if i need it i will enable it just for the moment and disable again.


Disable UPnP-IGD at your Router to prevent software on devices inside your network from being able to setup "random port forwarding" without your consent or knowledge. Maintaining "manual port-forwarding" at your Router is a PITA, but it will at least this keeps "you" in control of Port-Forwarding. Malware programmers love UPnP-IGD-enabled Routers as it allows them to do whatever they want with your Router.

For some interesting reading, please review the following documents:


You can have "convenience" (UPnP-IGD enabled), or you can have "security" (UPnP-IGD disabled). You can not have both. Personally, my UPnP-IGD is disabled at my Router, so I endure the pain of manual Port-Forwarding.

Patrick M. Wilson
Victoria, BC Canada
QNAP TS-470 Pro w/ 4 * Western Digital WD30EFRX WD Reds (RAID5) - - Single 8.1TB Storage Pool FW: QTS 4.2.0 Build 20151023 - Kali Linux v1.06 (64bit)
Forums: View My Profile - Search My Posts - View My Photo - View My Location - Top Community Posters
QNAP: Turbo NAS User Manual - QNAP Wiki - QNAP Tutorials - QNAP FAQs

Please review: When you're asking a question, please include the following.

User avatar
Don
Ask me anything
Posts: 9661
Joined: Thu Jan 03, 2008 4:56 am
Location: Long Island, New York
Contact:

Re: traffic towards port 6881

Postby Don » Sat Apr 23, 2016 7:48 pm

Not a NAS issue. If you have port forwarding turned off and you still see unsolicited traffic then your router is broken.
ADVICE - read the manual (online) and use the forum search feature (upper right hand corner) before posting.
Chances are very good you will find your answer.


It is a recommended to use RAID. It is also recommended to have external backups. RAID is designed to protect you from disk failure and keep your system running and data accessible while the disk is replaced and the RAID rebuilt. Backups will allow you to recover data that is lost or corrupted, or from catastrophic system failure. One does not replace the other.

Bugs and feature requests need to be submitted to QNAP via their helpdesk.

Online Manuals
QNAP Helpdesk

NAS: TVS-663 w/UX500P 4TB HGST NAS Drives | QM2-2P w/2 x 250gb RAID 1 cache | F/W: 4.3.3.0238
N/W: Netgear NightHawk R7800 router | SMC gigabit switch[/size]

User avatar
schumaku
Guru
Posts: 42254
Joined: Mon Jan 21, 2008 4:41 pm
Location: Kloten (Zurich), Switzerland -- Skype: schumaku
Contact:

Re: traffic towards port 6881

Postby schumaku » Wed Apr 27, 2016 4:31 am

Olinelooo wrote:I also do not have the port forwarding enabled for 6881 but still the connections open thru the firewall and end up reaching the nas endpoint.???
When you scroll some posts back - on the 15 April 2011 post I've placed a screenshot showing the controls in Download Station showing the options to enable/disable the UPnP IGD control.

jsarcone
New here
Posts: 3
Joined: Sat Aug 22, 2009 9:08 am

Re: traffic towards port 6881

Postby jsarcone » Wed Jun 01, 2016 8:14 am

I'm seeing the same thing and I'm going back and for with Qnap Support. Disabling Download Station didn't work. I had to disable the entire service from the application Center and UPnP from Discovery service. This seems to stop the flooded of request. When I changed my DNS from Google/OpenDSN to my ISP for troubleshooting I was flooded again with Spam. Once I change my DNS and turned off these service it has subsided but not completely stopped.
I really think that there is something going on here.


Return to “Download Station and QGet”

Who is online

Users browsing this forum: No registered users and 3 guests