High,
on my firewall I discovered that my QNAP establishes a connection to
- 159.69.64.142:443
- 139.162.140.7:443
on every boot for approx. 10 minutes. There are a few more addresses, but to these both IP addresses quite a lot of packets are exchanged. After approx. 10 minutes, the communications stops and is not seen until the next boot.
Any ideas,, what these IPs are for? I blocked them for now on my firewall.
Regards
Unknown traffic on boot
-
- Easy as a breeze
- Posts: 447
- Joined: Mon Nov 19, 2018 1:21 am
Re: Unknown traffic on boot
scan your machine for malware
-
- New here
- Posts: 7
- Joined: Mon Mar 18, 2019 10:37 pm
Re: Unknown traffic on boot
I run regular and recurring scans (malware remover, virus scan) and manual checks, if I get specific information.
However, this morning I got an error on my qnap (e-mail), that [Network & Virtual Switch] Failed to connect to the internet. System default gateway "Virtual Switch 1" and all adapters failed to connect to the internet after checking NCSI.
My presumption is, that at least one of the mentioned IP addresses is used for checking internet connectivity. However, this is up to now a presumption and can only be solved by qnap.
-
- Experience counts
- Posts: 2415
- Joined: Wed Jan 08, 2014 10:34 pm
Re: Unknown traffic on boot
An internet connectivity check will only use 4 or 5 packets - over and done with in milliseconds.My presumption is, that at least one of the mentioned IP addresses is used for checking internet connectivity.
If the traffic is persisting for 10 minutes - it's not an internet connectivity check.
You should be able to identify the responsible program if you use SSH to the NAS command shell and try something like :
lsof | grep "<one_of_the_implicated_IP_addresses>"
TS-431+ for storage and media and a bunch of IP cams under Surveillance Station. TVS-473 as files backup and QVR Pro.
-
- New here
- Posts: 7
- Joined: Mon Mar 18, 2019 10:37 pm
Re: Unknown traffic on boot
I checked the website by trying to connect to it and surprisingly one of the IPs (139.162.140.7) seems to belong to qnap, as the ssl-cert returns: *.api.myqnapcloud.com and the other IP seems to belong to musicbrainz. After a short search I read, that qnaps seem to connect to musicbrainz-servers/systems quite frequently. I have no clue, what app is doing the connections....AlastairStevenson wrote: ↑Fri Oct 01, 2021 5:36 pmAn internet connectivity check will only use 4 or 5 packets - over and done with in milliseconds.My presumption is, that at least one of the mentioned IP addresses is used for checking internet connectivity.
If the traffic is persisting for 10 minutes - it's not an internet connectivity check.
You should be able to identify the responsible program if you use SSH to the NAS command shell and try something like :
lsof | grep "<one_of_the_implicated_IP_addresses>"
-
- First post
- Posts: 1
- Joined: Mon Aug 09, 2021 11:05 am
Re: Unknown traffic on boot
musicbrainz, is a site that media server applications and player applications go to to update or get song or album information. If you have a DLNA media server like Plex or Twonky, there should be a setting in the preferences options, to update your music collection info on a regular basis with the musicbrainz site. there is also a setting to update on reboot. If you have a sizeable media collection, it can take some time to do those updates.
I'm not sure about the QNAP built in DLNA server. It may do something similar.
I'm not sure about the QNAP built in DLNA server. It may do something similar.