INTERACT FORUM

More => Old Versions => JRiver Media Center 20 for Windows => Topic started by: AJSchmidt on January 08, 2015, 02:48:28 pm

Title: Odd Internet Activity
Post by: AJSchmidt on January 08, 2015, 02:48:28 pm
The Activity Log Overview (Services & Plug-ins, Media Network) shows Active Interfaces: 192.168.1.20 (my PC), and a mysterious 25.144.127.184

The Activity Log entries show at 1-minute intervals an "interface" from an external IP address is generating a series of M-SEARCH and NOTIFY entries for port 1900 (UPnP).  That address "source" is 25.144.127.184 which is identified by http://www.ip-address.org/lookup as:  Organization: DINSA, Ministry of Defence, London, United Kingdom.  I am in the U.S.A and am not knowingly associated with DINSA, other than what MC is reporting. 

Is this a bug, or a normal internal feature of MC, or is my system really being probed by DINSA from London, England?





Title: Re: Odd Internet Activity
Post by: JimH on January 08, 2015, 03:01:34 pm
No idea.  Sorry.
Title: Re: Odd Internet Activity
Post by: ~OHM~ on January 08, 2015, 03:51:19 pm
wireless cell phones, I pads, internet ready TVs
Title: Re: Odd Internet Activity
Post by: kstuart on January 08, 2015, 03:56:00 pm
Maybe the memory leak is caused by Space Aliens, and they are being opposed by the UK Ministry of Defence ?
Title: Re: Odd Internet Activity
Post by: Ashfall on January 08, 2015, 10:17:31 pm
You should disable UPNP in your router.

http://www.forbes.com/sites/andygreenberg/2013/01/29/disable-a-protocol-called-upnp-on-your-router-now-to-avoid-a-serious-set-of-security-bugs/
Title: Re: Odd Internet Activity - Update: Source is inside computer, not from Internet
Post by: AJSchmidt on January 09, 2015, 01:40:57 pm
Today I unplugged my computer (Win8.0) from the network and found that the unidentified interface in MC v20.0.52 continued to generate the M-SEARCH and NOTIFY activities on port 1900, meaning that it's coming from inside the computer system. 

I then installed MC onto an older Win7 machine, disconnected from the network and found that MC had a similar unidentified interface on that system at IP address 25.124.88.107 which was listed by http://www.ip-address.org as the same (Organization: DINSA, Ministry of Defence), United Kingdom.  Okay, so after checking behind a few mirrors, framed wall art and telephone sets, I decided that these spooky IPAs could be a feature of my antivirus security system just keeping a lookout for trouble.  If that's the case, it's all good.

Title: Re: Odd Internet Activity
Post by: CountryBumkin on January 09, 2015, 02:02:44 pm
So what anti-virus program are you using? I don't see anything like that on my system.
Title: Re: Odd Internet Activity
Post by: ~OHM~ on January 09, 2015, 02:40:00 pm
I just gotta say that I don't get people and Anit-Virus software, I have had computers since before windows 95 (can't remember what was called back then 3.1 maybe) and have never never seen the need for this type of software. Don't get me wrong I'm no prude. Knowing what to click and what not to click or to terminate windows immediately goes a long way. Yes I have had problems with maleware but nothing compared to the problems I read here and elseware when using Anti-Virus software.....just had to say this and meant no disrespect!
Title: Re: Odd Internet Activity - Update: Source is inside computer, not from Internet
Post by: bob on January 09, 2015, 03:22:13 pm
Today I unplugged my computer (Win8.0) from the network and found that the unidentified interface in MC v20.0.52 continued to generate the M-SEARCH and NOTIFY activities on port 1900, meaning that it's coming from inside the computer system. 

I then installed MC onto an older Win7 machine, disconnected from the network and found that MC had a similar unidentified interface on that system at IP address 25.124.88.107 which was listed by http://www.ip-address.org as the same (Organization: DINSA, Ministry of Defence), United Kingdom.  Okay, so after checking behind a few mirrors, framed wall art and telephone sets, I decided that these spooky IPAs could be a feature of my antivirus security system just keeping a lookout for trouble.  If that's the case, it's all good.
Are you running virtualbox or vmare or some vpn software? I'm wondering what this "unidentified" interface is?
Title: Re: Odd Internet Activity
Post by: Ashfall on January 09, 2015, 04:28:00 pm
239.255.255.250:1900 is UPNP broadcasts.  Normally you will only see internal IP addresses searching (for other UPNP services) and notifying (advertising UPNP services).

I think your router is forwarding UPNP broadcasts from the Internet to your internal network, and whoever owns 25.144.127.184 is running UPNP searches over the Internet to find open devices such as webcams.

Check your router for UPNP and disable it.  Also check port forwarding, static routes, DMZ Server, etc.