PMS sending traffic to random IPs that are not watching anything

Plex Media Server
1

Server Version#: Version 1.19.4.2935

image
image976×512 155 KB

As you can see in the above image, resource monitor reports that Plex is sending about 2-3 mbps is being sent to the IP that is actually playing something back (24.141.XX.XXX), but then about 25 mbps is being sent to a random IP (24.36.36.XXX) that does not have access to the server and is not reported as anything playing in the dashboard. Plex’s bandwidth monitor also reports about 30 mbps being used but marks the stream from 24.141.XX.XXX as only 5 mpbs. Resource monitor also reports all of the traffic coming into 32400. My firewall rules in Windows Firewall allow Plex to communicate with any port, but no other traffic is specifically allowed in to 32400. My remote access setup is very simple, forwarding 32400 external → 32400 internal.

image
image976×512 186 KB

Plex also reports nothing about the random IP in the console, only the IP that is actually playing something.

image
image974×371 95.2 KB

This is now the 3rd time this has happened, with the IPs being different every time, even from completely different ISPs (some residential, some static business).

It may also be important to note that when these IPs are downloading from the server, they are using the max bandwidth which is allotted to this Windows server (30 mbps), so it could be some kind of attack.

What are some possible solutions to this problem? (Would forwarding a different external port than 32400 do anything?) I have tried changing my password and signing all devices out, as well as removing all non-home users.

2

Did you allow your shared users to download/sync content to their devices?

3

I do yes, but none of the IPs syncing content or using the server are any of the ones that seem to be abusing my network. I would also think something would show up in the console for that, no? (btw, only have a few home users, no invited users.) Also, checking in the ‘sync’ section of the server settings, there appears to be nothing synced to any devices.

4

Sync operations don’t appear in the Now Playing screen.

The Sync menu item only shows synced items on your own user account.

Sorry, I am confused by this.

5

Yes, I know they wouldn’t show up in now playing but I would think they might show up in the console logs. Also, there is only my account on the server; there is no other Plex account, only ‘home users’. From there I can see what everyone else has synced, which looks like nothing.

Sorry, that was poorly worded. None of the IPs that are doing this random downloading belong to anyone who uses the server, some of them were random business IPs from ISPs that don’t serve our area.

6

Do you have anything in this input field?
Settings - Server - Network - ‘Show Advanced’ - “List of IP addresses and networks that are allowed without auth”

7

No there are no IPs allowed without auth

8

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.