Server Version#: 1.16.0.1226
Why is the Plex media server always talking to ir00t.com? It has a constant connection that runs traffic at a rate of 34 bytes/sec constantly. If I block this traffic, it switches to another IP. What is the purpose of this traffic?
AFAIK, not Plex related, and maybe Malware?
Definitely comes from the Plex Media Server Process. It is an HTTPS connection:
Plex\x20M 44474 kdb 83u IPv4 0xfad03e53536bc919 0t0 TCP 10.0.0.2:61415->45.33.125.156:https (ESTABLISHED)
UID PID PPID C STIME TTY TIME CMD
501 44474 1 0 Wed02AM ?? 35:29.64 /Applications/Plex Media Server.app/Contents/MacOS/Plex Media Server --from-auto-update
Your reverse domain lookup is using outdated information.
The IP belongs to Plex and is used for the https://support.plex.tv/articles/216766168-accessing-a-server-through-relay/ service. the ‘pubsub’ servers.
What this does is to tell plex.tv that your server is up, and that it can be reached.
So clients which have access permission to your server can get an up-to-date status information and the info under which address they can contact your server.
OK, thanks for the information, but what DNS name is this tied to so I can whitelist on my firewall? The reverse DNS specifies linode.com so I has used their customer lists to find the host and they had listed ir00t.com for that IP.
; <<>> DiG 9.10.6 <<>> 156.125.33.45.in-addr.arpa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1237
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;156.125.33.45.in-addr.arpa. IN A
;; AUTHORITY SECTION:
125.33.45.in-addr.arpa. 1799 IN SOA ns1.linode.com. dns.linode.com. 2019062434 7200 3600 604800 86400
;; Query time: 93 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon Jun 24 17:06:45 CDT 2019
;; MSG SIZE rcvd: 109
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.
