[Solved] Unusual traffic from my Plex server to some Linode hosted server in UK

Plex Media Server Desktops & Laptops
1

I’m running the latest official Plex docker image and my IDS just alerted on some SSH traffic over port 443 as a proxy evasion attempt. The destination ip address of the SSH traffic is 178.79.142.46. According to Shodan, this server is hosting an openSSH service on port 443.

Is this normal Plex traffic?

2

See:

https://www.google.com/search?source=hp&ei=7ZdTXOHoFKnLjgTN3afwBw&q=plex+members+linode&oq=plex+linode&gs_l=psy-ab.1.2.0j0i22i30l2.1322.4580…7976…0.0…0.256.1350.4j7j1…0…1…gws-wiz…0…35i39j0i131.X9CFGD0kHgU

3

Turned out to be an ssh tunnel Plex uses for their Relay feature. I understand why this is done over port 443 and not 22. If this is documented somewhere, I couldn’t find it.

4

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.