Plex creating thousands of outbound ssh connections?

Plex Media Server
1

Server Version#: 1.40.0.7775

OK… the strangest thing happened over the last week or two… after purchasing plex-pass, i noticed my internet slowing down… I started to seeing mallocfail and chunkexpandmanger syslog’s from my cisco router… failing expanding the pool for ipnat… looking at the sessions created and nat translations i’m seeing an astounding 200-300k ssh sessions from plex to the internet.

Total active translations: 300541 (0 static, 300541 dynamic; 300543 extended)
Peak translations: 300544, occurred 00:52:14 ago
Outside interfaces:
  GigabitEthernet0/0
Inside interfaces: 
  GigabitEthernet0/1
Hits: 95170443  Misses: 0
CEF Translated packets: 88387688, CEF Punted packets: 34218440
Expired translations: 20905568
Dynamic mappings:
-- Inside Source
[Id: 1] access-list HOME_NAT_LAN interface GigabitEthernet0/0 refcount 300534

netstat on plex (ubuntu 22.04.3 LTS) also shows… but can’t find out what is starting these sessions… ps shows nothing so I’m guessing something in python is doing it? I know nothing about python…

tcp        0      0 50.92.xxx.xx:41012      139.104.232.134:22      ESTABLISHED
tcp        0     68 50.92.xxx.xx:34008      139.104.232.181:22      ESTABLISHED
tcp        0     48 50.92.xxx.xx:39052      139.104.232.183:22      ESTABLISHED
tcp        0     68 50.92.xxx.xx:47980      139.104.186.2:22        ESTABLISHED
tcp        0     12 50.92.xxx.xx:47772      139.104.232.143:22      ESTABLISHED
tcp        0      0 50.92.xxx.xx:47752      139.104.232.143:22      ESTABLISHED
tcp        0      0 50.92.xxx.xx:54172      139.104.232.157:22      ESTABLISHED
tcp        0     12 50.92.xxx.xx:34020      139.104.232.181:22      ESTABLISHED
tcp        0     68 50.92.xxx.xx:48618      139.104.232.165:22      ESTABLISHED
tcp       21      0 50.92.xxx.xx:52080      139.104.232.158:22      ESTABLISHED
tcp        0     12 50.92.xxx.xx:35266      139.104.232.177:22      ESTABLISHED
tcp        0     12 50.92.xxx.xx:57198      139.104.232.182:22      ESTABLISHED
tcp        0     48 50.92.xxx.xx:52458      139.104.232.187:22      ESTABLISHED
tcp        0     12 50.92.xxx.xx:37388      139.104.186.1:22        ESTABLISHED
tcp        0   1040 50.92.xxx.xx:47988      139.104.186.2:22        ESTABLISHED
tcp        0     68 50.92.xxx.xx:34420      139.104.232.142:22      ESTABLISHED
tcp        0     12 50.92.xxx.xx:53336      139.104.232.188:22      ESTABLISHED
tcp      264      0 50.92.xxx.xx:59294      139.104.232.221:22      ESTABLISHED
tcp        0     12 50.92.xxx.xx:48716      139.104.232.160:22      ESTABLISHED
tcp        0     68 50.92.xxx.xx:35256      139.104.232.177:22      ESTABLISHED

This was a fresh Ubuntu server install.

Anyone run into this before??

2

Nothing like that on my system.

However, those two networks are owned by Disney.

Anything Disney/ABC/ESPN related on the box?

3

This isn’t Plex… unless you’ve installed a plug-in?

CIDR:           139.104.232.0/24
NetName:        ABCNEWS
NetHandle:      NET-139-104-232-0-1
Parent:         DISNEY (NET-139-104-0-0-1)
NetType:        Reassigned
OriginAS:       
Organization:   Disney Worldwide Services, Inc. (DWS)
RegDate:        2023-01-25
Updated:        2023-06-06
Ref:            https://rdap.arin.net/registry/ip/139.104.232.0


OrgName:        Disney Worldwide Services, Inc.
OrgId:          DWS
Address:        500 South Buena Vista Street
City:           Burbank
StateProv:      CA
PostalCode:     91521
Country:        US
RegDate:        1992-07-17
Updated:        2023-10-16
Ref:            https://rdap.arin.net/registry/entity/DWS
4

@FordGuy61

hrm…Interesting, I did attempt to add Disney+ as a streaming service, hoping I could add my wife’s account to plex… but found out later it won’t work. I never did remove that… I’ll do it now.

@ChuckPa not a single plugin, just the bare install and a few shows to test around the house.

Will update soon, thanks for the help!

5

well…it seems selecting Disney+ as a streaming service is what did it.
@FordGuy61 @ChuckPa thanks for the hint.

I was looking for something rouge and hidden… not a checkbox right in front of my face…

20_C2951#show ip nat statistics
Total active translations: 463 (0 static, 463 dynamic; 465 extended)

6

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.