Multiple unknown destination IP addresses originating from Plex iOS app

Server Version#: 1.21.2.3918 (PlexPass)
Player Version#: 7.11

Examined my firewall logs and found packets destined for the Plex TCP port 32400 within my network being blocked because they are destined for addresses that are not assigned to clients in my network.

Plex Media Server lives at 192.168.1.13 <-- clients in this network are limited and restricted.
The iOS device is assigned 192.168.10.126 <-- clients in this network are my “family” devices.

And packets being sent by my iOS device are destined for the following addresses:
192.168.1.175
192.168.1.200
192.168.1.201
192.168.1.224
192.168.1.236 Updated

I’ve proven that these addresses appear (and are properly being blocked at my router firewall) when launching the iOS app. Tried uninstalling the iOS app and reinstalling - same behavior. These addresses are sticky to either the app or something in my configuration that I’m not able to pinpoint. Perhaps some hard-coded test/debug addresses?

Also, I tried to replicate on a Mac using the macOS app and have not seen the same behavior. Makes me feel that there isn’t anything wrong with my configuration data.

Anyone else have these packets in their firewall logs?

I connected my iPhone to my IoT network and enabled logging on the firewall rule which blocks new IoT to LAN connections. When I opened the Plex app on my phone, the only connection attempts it logged were for it attempting to connect to my servers’ IP addresses.

Try browsing to this address to see what IP addresses it has listed for your servers and clients:

https://plex.tv/api/resources?X-Plex-Token=plex_online_token

Replace “plex_online_token” with your token. You can also find your token:

  • Linux - Preferences.xml
  • macOS - defaults read com.plexapp.plexmediaserver PlexOnlineToken
  • Windows - Plex registry key (HKEY_CURRENT_USER\SOFTWARE\Plex, Inc.\Plex Media Server

Do any of the IP addresses listed match the ones from your list above?

Note: If you visit this page using Safari, and you don’t have the “Develop” menu enabled, the page may appear blank. If so, right-click in the window and Save Page As…, and view the resulting XML file.

You have several shared servers. These IPs are used by these servers in their own local networks.
Plex clients simply try any possible way to reach the servers. Preferred are always the local connection types, so these are tried first.
Plex clients cannot know which network routes exist, so all listed connections of servers are tried.

1 Like

Thank you, Otto. I checked the local addresses assigned to my Shared Servers - indeed, the addresses match (although I only have 4 Shared Servers and there are 5 addresses).

Just curious…

If any of the Shared Servers had used the same address as my Server, would there be a problem?

Is there a way to “see” the mapping of these Shared Servers to their IP address somewhere in a config or log file ?

That’s what the info I posted above was intended to provide…

Phillip - my apologies - you are right and I didn’t follow your instructions.

Once I located my token, followed the URL you provided and ALL of the addresses are accounted for. Looks like in one case, there are 2 addresses for the shared server: the current address, and one from some time in the past (perhaps months ago).

Mystery solved.

Thanks for the insights!

1 Like

No problem, glad it worked. I’m curious: Do these show as “local=0” or “local=1” in the connection info? If it’s “local=0” I wonder if there’s an opportunity for the client apps to be changed to not attempt to connect if it’s an RFC 1918 address.

They are tagged with local=“1”

Looking at the complete list (which includes my server and the same local=“1”), how would the client know which of the servers are actually reachable?

This is the point that Otto made earlier.

It was just curiosity as I don’t connect to any shared servers. I thought perhaps they’d be tagged as non-local since they’re shared with you. That might not work in the case where there was a shared server on a local network however. So, as Otto stated, the only way for the client to know their reachability would be to try to connect.

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.