Log flooded with "Error sending out discover packet"

Hello,
I run my Plex server on a Rasperry pi 4 with OpenMediaVault. Plex is running from a Docker container in host network mode.
I noticed some time ago that my disk start spinning every 5 minutes for no apparent reason, it turns out Plex log file is being updated.
I went to the web interface and check the console. I notice this warning occurring every 10s:

Jan 17, 2020 17:48:31.592 [0xf3d21450] Warning — NetworkServiceBrowser: Error sending out discover packet from 192.168.x.x to 239.255.255.250: Operation not permitted

192.168.x.x is actually 3 different addresses, corresponding to every active network interface from my Pi.

I have tried:

  • disabling DLNA
  • disabling GDM

How can I fix this issue? Can I somehow stop the service using SSDP ? Can I add some IP routes to my host to allow these request to go through ?

Server Version#: 1.18.2.2029
Player Version#: 4.8.4

1 Like

Have you verified that multicast is enabled on these interfaces? From a terminal, within the container, run ‘ip addr’ and verify the MULTICAST flag is present:

2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

Also, this could be caused by a firewall issue. I’m not very familiar with OpenMediaVault, but I believe it has a built-in firewall. You could try ensuring multicast traffic is allowed through, or temporarily disable it (and do the same for any firewall/iptables config in the container) to see if that’s the issue.

1 Like

I have the exact issue, I even made a post about it. No one knows apparently how to deal with this.
My logs spawn this message every 10 seconds.

Im on openmediavault, linuxserver docker in host mode. Could be particular to linuxserver’s docker image? Don’t know.
Do you also have reverse proxy with letsencrypt container?

@pshanew

root@pozz:/home/ciss# docker exec -it plex /bin/bash
root@pozz:/# ip addr
bash: ip: command not found

LE: can confirm, it’s a OMV firewall issue. As soon as I disable it, no more error. Now we need to figure out which ports are needed to be whitelisted.

UDP port 1900 is generally used for SSDP multicast, so that would be a good place to start. I’m not sure what the rule would look like though.

[Edit]
Also, here’s a more generic list of IP ports needed for various services in a Plex environment:

It lists 1900 for DLNA, but it’s used for other services whose foundation is SSDP.

Yep found it.
So @antoine_raynard_plex_pm_me you need to add 2 rules
Go to network>firewall
New rule > accept output , source IP 192.168.0.0/16 (LAN ips) and 2nd
172.16.0.0/12 (docker lan ips) to destination ip 239.255.255.250 and port 1900 UDP

Thats it. Thanks @pshanew

1 Like

No problem, glad you figured the correct rule out.

Thank you Ciss1 ! It did the trick !
I used slightly different rules and I used only 2:

First rule - LAN network:
Family: IPv4
Direction: OUTPUT
Action: ACCEPT
Source 192.168.0.0/24
Source port:
Destination: 239.255.255.250
Destination port: 1900
Protocol UDP

Second rule - Docker network:
Family: IPv4
Direction: OUTPUT
Action: ACCEPT
Source 172.17.0.0/16
Source port:
Destination: 239.255.255.250
Destination port: 1900
Protocol UDP

Let me know if it’s a risk to allow an IP range for my LAN instead of just the host address. It didn’t seem to work for me with just the host address because it has actually 2 IP addresses, to make Pihole work as a DHCP from another Docker in macvlan mode.

After all, it seems I do need a firewall rule with a specific network interface of my host:

Family: IPv4
Direction: OUTPUT
Action: ACCEPT
Source 192.168.0.2 #My NAS Ethernet interface
Source port:
Destination: 239.255.255.250
Destination port: 1900
Protocol UDP

I think 2 rules with the largest CDIR ip blocks will suffice

192.168.0.0/16
172.16.0.0/12

The problem is not fixed :frowning:
Whenever I apply changes to my firewall in OMV the warning stops for a while. But some time later (I would say 1 hour, but I’m not sure) it comes back at the same rate.

Hello ciss1
I applied the rules you suggested, the problem stopped for about 45 minutes before starting again.
I looks like it doesn’t matter what Firewall rule I apply, it will stop the warning for some time before starting again to flood the log…

@antoine_raynard_plex_pm_me

In my case, these 2 rules solved the issue for good.

Clipboard01

I applied the rules you suggested, the problem stopped for about 45 before starting again.
I looks like it doesn’t matter what Firewall rule I apply, it will stop the warning for some time before starting again to flood the log…

What ips are still showing in the logs now? These rules should cover all lan IPs.
172.16.0.0 through 172.31.255.255 and 192.168.0.0 through 192.168.255.255

Do note, I don’t use DLNA and GDM so I have those services disabled in the plex server. I use plex with reverse proxy (letsencrypt container) and only ports 32400 and 443 are opened on my router.

Hello ciss1,
The same ip’s are showing, all from my LAN (192.168.0.0/24).
I also don’t use GDM nor DLNA, I also disabled them in Plex.
My router doesn’t allow me to manage ports…
Finally, I’m not using Plex remote access, it is also disable.

A silly question, but did you make sure, after creating the firewall rules, you place them ABOVE the last 2 rules blocking everything else? Check your iptables again.

If you plex log still shows ips from the lan (which are normally allowed by enforcing those 2 rules), there’s something fishy about your firewall settings, they may not be applied correctly.

I only have only these 2 rules in my OMV firewall:

From my host, the IP table looks like this, no idea if there is something wrong showing (my knowledge of networking doesn’t go beyond IP, masks and MAC address):

sudo iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  192.168.0.0/16       239.255.255.250      udp dpt:1900
ACCEPT     udp  --  172.16.0.0/12        239.255.255.250      udp dpt:1900

Chain DOCKER (1 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere 

That is weird. You don’t need the rules in the first place since you’re not firewalled at all, therefore those 2 rules are not needed since your firewall allows everything.

I really do not know what blocks your ports :frowning:

Are those SSDP request suppose to leave my LAN ? In this case, do I have a way to stop the service emitting them ?
As a last resort can I disable the Media Server Logging ? This would prevent my drive to spin-up every 5 minutes.

It looks like the problem comes from OMV, my Firewall rules seem to reset to default after random times. I will look into this…

The “default” iptables look like this:

sudo iptables --list
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  127.0.0.0/8          anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  172.17.0.0/16        anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  pinas                anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  179.48.249.131       anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.8.8.0/24          anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  192.168.0.0/24       anywhere             ctstate NEW,RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             103.86.99.99         udp dpt:domain
ACCEPT     udp  --  anywhere             103.86.96.96         udp dpt:domain
ACCEPT     udp  --  anywhere             103.86.99.99         udp dpt:domain
ACCEPT     udp  --  anywhere             103.86.96.96         udp dpt:domain
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             127.0.0.0/8         
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             172.17.0.0/16       
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             pinas               
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             179.48.249.131      
ACCEPT     all  --  anywhere             10.8.8.0/24         
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             192.168.0.0/24      
ACCEPT     all  --  anywhere             anywhere            

Chain DOCKER (1 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere 

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.