Phantom Connections to my DVR

I am getting these phantom connections to my DVR server that last only a few seconds but repeat every few mins. I have restarted the ChannelsDVR software multiple times and I have restarted the physical machine. But the connections keep happening.

I tried turning on " HTTP Logging" to see if I could get more info. The IP address is my physical server.

2021/01/13 15:28:49.337531 [HLS] Stopping inactive session ch6030-dANY-ip192.168.7.219
2021/01/13 15:28:49.337604 [HLS] Stopping transcoder session ch6030-dANY-ip192.168.7.219 (out: 23.952689s, finished: false)
2021/01/13 15:28:49.367380 [TNR] Closed connection to TVE-Cablevision for ch6030 CNN

Here is the diagnostics id: 3ead18a2-025b-469c-91d1-eef76c247c92

You can maybe use netstat or lsof to figure out where the connections are coming from.

This command will show all processes connected to 8089:

lsof -i :8089

Do you have it serving up an m3u playlist?
If so, most likely something is accessing the m3u.

I am only seeing connections from the ChannelsDVR Server itself no clients. And it is always the same channel, 6030.


COMMAND    PID     USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
channels- 1129 XXXXXXX    8u  IPv6 0xf1f5bf665f5b1fc9      0t0  TCP *:8089 (LISTEN)
channels- 1129 XXXXXXX   32u  IPv6 0xf1f5bf665c0ea2e9      0t0  TCP 192.168.7.219:8089->192.168.7.219:54327 (ESTABLISHED)
channels- 1129 XXXXXXX   85u  IPv6 0xf1f5bf665cb0a2e9      0t0  TCP localhost:8089->localhost:54334 (ESTABLISHED)
com.apple 5315 XXXXXXX    5u  IPv4 0xf1f5bf667e37b739      0t0  TCP 192.168.7.219:54327->192.168.7.219:8089 (ESTABLISHED)
ffmpeg    5321 XXXXXXX    4u  IPv4 0xf1f5bf665d7e2de1      0t0  TCP localhost:54334->localhost:8089 (ESTABLISHED)```

Not intentionally. I have the TVE setup and I know you can access the m3u playlist for TVE, but I am not purposefully using that.

What is this?

You can run ps eww 5315 to get a full listing and see what random Apple process is connecting to your dvr

26689   ??  Ss     0:00.05 /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

It appears Safari is doing something weird. I closed safari for about an hour and the connections stopped. When I started Safari and opened a blank window the connections immediately appeared. Close and reopen Safari and it did it again. It also, is trigger when new blank tabs are opened.

I was doing some cut and paste of streams directly into the location bar, like:

http://XXXX:8089/devices/ANY/channels/XXXX/hls

I looked into my history of safari and I deleted any past visits to those URLs. Restarted safari and the problem is now gone. Very strange behavior.

2 Likes

Glad you sorted it out, but definitely strange. Wonder what Safari was doing with its history that caused it.

Random thought, maybe Safari is verifying previously visited links. You know how those will appear in a different color font vs. those not visited.