ColonelRhodes

Members
  • Posts

    106
  • Joined

  • Last visited

Posts posted by ColonelRhodes

  1. I'm going to also try rolling back for my issue discussed here. Unless anyone else have seen a similar issue.

    On 9/8/2018 at 11:05 AM, ColonelRhodes said:

    My Deluge docker no longer recognizes what I input for Download/Upload speed. I can set the max download to 100kbps and it will still download at a full 10Mbps which is maxing out the rest of my network. Any idea of what is going on here? It seems like deluge is overriding my settings with Unlimited bandwidth.

     

  2. My Deluge docker no longer recognizes what I input for Download/Upload speed. I can set the max download to 100kbps and it will still download at a full 10Mbps which is maxing out the rest of my network. Any idea of what is going on here? It seems like deluge is overriding my settings with Unlimited bandwidth.

  3. 3 hours ago, CHBMB said:

     

    Nothing springs to mind, not a lot to go on though.

     

    I know it's not much to go off, basically I used to be able to login from my phones web browser and download the .ovpn file to use to make the auto login profile. It still does that, but never actually connects. I'm going to try on a different iOS device. Maybe it's something due to the version I'm running.

  4. 1 minute ago, jonathanm said:

    +1

    It's amazing the number of popular routers that have had their most recently available firmware versions compromised. Typically if the router is over a couple years old and was sold in any mass quantity, it's been hacked.

     

    Thats an interesting idea. It's an ASUS router. But I guess it wouldn't be a bad idea to just reformat it back to factory settings and clear the NVRAM.

  5. 3 hours ago, TSM said:

    Sort of old thread but, I'm just curious.  Are you sure the email was actually from your ISP, and not just some scam?  I don't know...  I mean if you called them and they said there wasn't a problem?

     

    100% sure. I've been in contact with the security team of my ISP over the past few months.

  6. I'm not even sure where to start with my IoT devices. I currently have Philips Hue, 2 Nest thermostats, and 1 weemo outlet. They are all on static IP addresses. Not sure if I should reassign them or just "reset" them back to factory settings.

  7. I have called my ISP back two weeks in a row and they say no reports have come back with any potential threats, but I just received another email this morning for the same thing. I'm not sure if I should be look towards my unRaid or something else at this point.

  8. Any direction that I should look here? I did a tcpdump last night (2GB file!)

     

    I'm going to try and coordinate that with the time my sip provides me if there was any botnet activity. Hopefully to find an answer.

  9. Do you have any Internet of Things devices in your house that connect wirelessly to the Internet, security cameras, tablets, anything that uses wifi?

     

    Yes. Philips Hue and other things like that. Of course iPhone and iPads as well.

     

    Is your unraid machine or any of its VM's or apps exposed to the internet? Have you opened any ports in your router, or put the unraid ip in a "DMZ"? Post a diagnostics.zip file, it may contain some clues.

     

    I have a few docker images that have open ports, yes. I would never turn DMZ on though, haha.

     

    I'm attaching the diagnostics archive if you wouldn't mind. Thank you!

    tower-diagnostics-20170120-2008.zip

  10. Just received a letter from my ISP about one the computers on my home network being infected with a botnet (or flagged for connecting to a botnet host). I can't really think of how this would be possible on my unraid system, but I was looking for some advice on where to start looking just in case.

     

    I only have one other "desktop" computer in my house. It's an iMac. That system was scanned for malware, but I still want to make sure my unraid isn't doing anything weird. Maybe there are logs I can look at for clues. I have plenty of dockers installed, but all are from legitimate sources like linuxserver.io

     

    Thanks for any help you can provide. I was told I can call my ISP security team in a week to see if any more activity was detected.

  11. I've had this issue for a long time, but didn't quite understand what was going on. I would get countless number of "Received packet from invalid interface." from avahi-daemon in my syslogs. I have ruled the issue to being caused by the Home-Assistant docker.

     

    I ran an strace on the avahi-daemon and am finding some interesting things. For some reason, three items in my house are being mentioned in the results from strace with that error message. My network printer, my philips hue bridge, and my vizio soundbar with GoogleCast. This is what the errors look like.

     

    09:25:37 recvmsg(13, {msg_name(16)={sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("172.27.231.1")}, msg_iov(1)=[{"\0\0\0\0\0\1\0\1\0\0\0\0\v_googlecast\4_tcp\5local\0\0\f\0\1\300\f\0\f\0\1\0\0\0\24\0(\17Vizio Sound Bar\v_googlecast\4_tcp\5local\0", 92}], msg_controllen=56, [{cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=8, ...}, {cmsg_len=20, cmsg_level=SOL_IP, cmsg_type=2, ...}], msg_flags=0}, 0) = 92
    09:25:37 sendto(3, "<28>Sep  4 09:25:37 avahi-daemon[14623]: Received packet from invalid interface.", 80, MSG_NOSIGNAL, NULL, 0) = 80

     

    09:25:37 recvmsg(13, {msg_name(16)={sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("172.27.234.1")}, msg_iov(1)=[{"\0\0\0\0\0\1\0\1\0\0\0\0\4_hap\4_tcp\5local\0\0\f\0\1\300\f\0\f\0\1\0\0\16|\0&\24Philips hue - 208A86\4_hap\4_tcp\5local\0", 83}], msg_controllen=56, [{cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=8, ...}, {cmsg_len=20, cmsg_level=SOL_IP, cmsg_type=2, ...}], msg_flags=0}, 0) = 83
    09:25:37 sendto(3, "<28>Sep  4 09:25:37 avahi-daemon[14623]: Received packet from invalid interface.", 80, MSG_NOSIGNAL, NULL, 0) = 80

     

    09:25:37 recvmsg(13, {msg_name(16)={sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("172.27.224.1")}, msg_iov(1)=[{"\0\0\0\0\0\1\0\1\0\0\0\0\5_http\4_tcp\5local\0\0\f\0\1\300\f\0\f\0\1\0\0\31\10\0$\21Brother MFC-7360N\5_http\4_tcp\5local\0", 82}], msg_controllen=56, [{cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=8, ...}, {cmsg_len=20, cmsg_level=SOL_IP, cmsg_type=2, ...}], msg_flags=0}, 0) = 82
    09:25:37 sendto(3, "<28>Sep  4 09:25:37 avahi-daemon[14623]: Received packet from invalid interface.", 80, MSG_NOSIGNAL, NULL, 0) = 80

  12. I ran an strace on the avahi-daemon and am finding some interesting things. For some reason, three items in my house are being mentioned in the results from strace with that error message. My network printer, my philips hue bridge, and my vizio soundbar with GoogleCast. This is what the errors look like.

     

    09:25:37 recvmsg(13, {msg_name(16)={sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("172.27.231.1")}, msg_iov(1)=[{"\0\0\0\0\0\1\0\1\0\0\0\0\v_googlecast\4_tcp\5local\0\0\f\0\1\300\f\0\f\0\1\0\0\0\24\0(\17Vizio Sound Bar\v_googlecast\4_tcp\5local\0", 92}], msg_controllen=56, [{cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=8, ...}, {cmsg_len=20, cmsg_level=SOL_IP, cmsg_type=2, ...}], msg_flags=0}, 0) = 92
    09:25:37 sendto(3, "<28>Sep  4 09:25:37 avahi-daemon[14623]: Received packet from invalid interface.", 80, MSG_NOSIGNAL, NULL, 0) = 80

     

    09:25:37 recvmsg(13, {msg_name(16)={sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("172.27.234.1")}, msg_iov(1)=[{"\0\0\0\0\0\1\0\1\0\0\0\0\4_hap\4_tcp\5local\0\0\f\0\1\300\f\0\f\0\1\0\0\16|\0&\24Philips hue - 208A86\4_hap\4_tcp\5local\0", 83}], msg_controllen=56, [{cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=8, ...}, {cmsg_len=20, cmsg_level=SOL_IP, cmsg_type=2, ...}], msg_flags=0}, 0) = 83
    09:25:37 sendto(3, "<28>Sep  4 09:25:37 avahi-daemon[14623]: Received packet from invalid interface.", 80, MSG_NOSIGNAL, NULL, 0) = 80

     

    09:25:37 recvmsg(13, {msg_name(16)={sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("172.27.224.1")}, msg_iov(1)=[{"\0\0\0\0\0\1\0\1\0\0\0\0\5_http\4_tcp\5local\0\0\f\0\1\300\f\0\f\0\1\0\0\31\10\0$\21Brother MFC-7360N\5_http\4_tcp\5local\0", 82}], msg_controllen=56, [{cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=8, ...}, {cmsg_len=20, cmsg_level=SOL_IP, cmsg_type=2, ...}], msg_flags=0}, 0) = 82
    09:25:37 sendto(3, "<28>Sep  4 09:25:37 avahi-daemon[14623]: Received packet from invalid interface.", 80, MSG_NOSIGNAL, NULL, 0) = 80

     

    I know this post is outside of the "Docker" topic, so I might move it elsewhere.

  13. I've had this issue for a long time, but didn't quite understand what was going on.

     

    I would get countless number of "Received packet from invalid interface." after running 'docker log plex'

     

    I read that it was some issue with avahi-daemon, but now I'm thinking something else. When I check the docker logs for plex it is rendering my system almost completely useless. the docker process uses over 100% CPU utilization and the WebUI is unresponsive. As soon as I kill the docker log command it returns to functional again.

     

    Is there a way to "clear" past logs from that docker log command? Or should I be looking into another fix?

  14. the "issue" if there is one, is to do with dbus/avahi and not with plex itself. avahi announces and listens on the local network and some of the returns it gets from different clients trigger the message.

    macs/windows machines are just two of the clients that can result in the messages, there may well be others.

     

    Good to know that information. I will start looking into what may be causing it. The log gets reported constantly, whether or not something is streaming from Plex or not.

     

    Seems like it could be due to a bridge set up from the Unraid GUI? https://lime-technology.com/forum/index.php?topic=38684.0

     

    Currently I have...

    Setup Bridge: Yes

    Bridge name: br0

  15. Any reason why I am continuously getting

    Received packet from invalid interface.

    from my Plex Logs when running docker logs plex?

     

    What version of Unraid you using?  I used to see this in my syslog a few releases back, I remember it being harmless and that archedraft and I both saw the same thing.

     

    I have not seen those in Plex logs, however they have been sighted in UnRaid logs and IIRC they are harmless communication with windows 10 pcs (vague recollection)? You should not have them with the latest 6.1.9 version as they have been suppressed.

     

    I am using 6.1.9

    No Windows 10 PC's in the house. No Windows machines at all actually.

    When I open up my syslog in the unraid gui this is pretty much the only log I see repeated to infinity....and it is definitely coming from Plex.

     

    Issue persists with v1.0