Unknown traffic on boot

[webspyder]

High,

on my firewall I discovered that my QNAP establishes a connection to
- 159.69.64.142:443
- 139.162.140.7:443
on every boot for approx. 10 minutes. There are a few more addresses, but to these both IP addresses quite a lot of packets are exchanged. After approx. 10 minutes, the communications stops and is not seen until the next boot.

Any ideas,, what these IPs are for? I blocked them for now on my firewall.

Regards

[Thisisnotmyname]

scan your machine for malware

[webspyder]

scan your machine for malware

I run regular and recurring scans (malware remover, virus scan) and manual checks, if I get specific information.

However, this morning I got an error on my qnap (e-mail), that [Network & Virtual Switch] Failed to connect to the internet. System default gateway "Virtual Switch 1" and all adapters failed to connect to the internet after checking NCSI.

My presumption is, that at least one of the mentioned IP addresses is used for checking internet connectivity. However, this is up to now a presumption and can only be solved by qnap.

[AlastairStevenson]

My presumption is, that at least one of the mentioned IP addresses is used for checking internet connectivity.

An internet connectivity check will only use 4 or 5 packets - over and done with in milliseconds.
If the traffic is persisting for 10 minutes - it's not an internet connectivity check.

You should be able to identify the responsible program if you use SSH to the NAS command shell and try something like :

lsof | grep "<one_of_the_implicated_IP_addresses>"

[webspyder]

My presumption is, that at least one of the mentioned IP addresses is used for checking internet connectivity.

An internet connectivity check will only use 4 or 5 packets - over and done with in milliseconds.
If the traffic is persisting for 10 minutes - it's not an internet connectivity check.

You should be able to identify the responsible program if you use SSH to the NAS command shell and try something like :

lsof | grep "<one_of_the_implicated_IP_addresses>"

I checked the website by trying to connect to it and surprisingly one of the IPs (139.162.140.7) seems to belong to qnap, as the ssl-cert returns: *.api.myqnapcloud.com and the other IP seems to belong to musicbrainz. After a short search I read, that qnaps seem to connect to musicbrainz-servers/systems quite frequently. I have no clue, what app is doing the connections....

[leftstrat]

musicbrainz, is a site that media server applications and player applications go to to update or get song or album information. If you have a DLNA media server like Plex or Twonky, there should be a setting in the preferences options, to update your music collection info on a regular basis with the musicbrainz site. there is also a setting to update on reboot. If you have a sizeable media collection, it can take some time to do those updates.

I'm not sure about the QNAP built in DLNA server. It may do something similar.