System pinging Craigslist every minute


Recommended Posts

Long time Unraid user, first time poster so thank you in advance.

 

For the last 6 months I have been frequently dealt an IP ban from the PSN network (Error code WS-37397-9) & Craigslist. Weird, I know. I have swept all my non-unraid systems for virus/malware multiple times to remedy this to no avail so I thought I'd dive into my Unraid box's network traffic and do some digging. 

 

Method:

- disabled all Docker containers other than Darkstat

- Active plugins:

  • Community Applications and all dependencies (CA autoupdate applications, etc)
  • Dynamix Sys Info, Sys Statistics, WebGUI
  • Recycle Bin

 

Everything is up-to-date as of this post.

 

I was really looking for the PSN traffic problem but immediately I see Craiglist being pinged about every minute. (See attached)

 

Has anyone run into this? I have no idea this box or any microservice would want to request craigslist's homepage every minute.

 

Thanks again

 

 

Screen-Shot-2017-05-19-at-5.32.34-PM.gif

Edited by MadeOfCard
Link to comment

Hey all

 

No solution just another question to add to the OP.

After I read this post

I wondered the same thing, for those of us that do not have the vm's or any sort of containers running on my unriad box.

Is there any way from the cli to see what traffic is leaving the unraid box with build a second machine or sniffing a hub from another pc.

 

Thank You

Link to comment

Sorry for answering my own question:$

But I saw I had the nerd tool plugin installed and iftop was in it so is that telling me ALL the traffic coming from my unraid box or only the top talkers?

 

so using iftop i was able to see what ip's my box was talking to.

 

am I right ?

 

apologies for hijacking the thread, was not my intentionO.o

 

thank you

Link to comment
  • 5 months later...

iftop focuses on information about the biggest ongoing transfers, just as top focuses on the processes that consumes most CPU or memory. So if your box has lots of connections, then you may not see any spurious extra connects.

 

One tool that is always available is netstat.

netstat -Wpa

gives lots of nice information about active connections and listeners and also a list of recent TCP connects that ended within the last minutes.

For current connects/listeners it also tells the name and PID of the process. It can be hard to catch actual process information for short and quick connects but netstat may still show a 

 

The best way to capture all connects is to make use of the iptables firewall and log connects. But that requires knowledge since it isn't practical to just paste in some boiler plate lines found on the net - the iptables commands depends on actual interface names, IP ranges etc.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.