What is it that is running on port 1126?

It’s marked as hpvmmdata as common port usage, but I’m running clean OSMC on a RPi2 so it can’t be nothing related to HP.
Netstat displays that is being used by Kodi.bin service. When going through the tree of the service it says that is being used by /usr/lib/kodi/kodi.bin --standalone -fs --lircdev /var/run/lirc/lircd.
It’s a new installation, and I changed SSH port and every password to non dictionary ones plus I’m not seen anything strange in the logs.

Also I don’t have anything plugged on the GPIO nor I have lircd enabled by any mean and it’s always running, whether I’m using the mediacenter or not, and never using any IR device. It usually takes about 15 % of CPU usage an 20 % of RAM.
Can someone help me or at least orient me?

Hi. Can you show us the netstat details and anything else that might help us to diagnose the issue?

You don’t say whether kodi.bin s listening on port 1126. I checked my installation and currently nothing is listening on that port, but it might, for example, only open it from time to time.

Here’s the ps output on my machine for kodi.bin:

1463 ? Sl 636:03 /usr/lib/kodi/kodi.bin --standalone -fs --lircdev /var/run/lirc/lircd

and top shows:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1463 osmc 20 0 790564 223092 26772 S 15.9 12.0 636:41.37 kodi.bin

I also don’t have lircd enabled, so this is simply how it works. Kodi.bin is generally the heaviest process on the box, so no worries there.

So now it disappeared, but another one apeared on the port 52856 (I guess thats a random one) and outputing to the router 1990 port. I’ve looked for it on the Internet and it’s usually used for “Cisco STUN Priority 1 port”. But as I don’t have any Cisco hardware it must be another thing, that I don’t really know.
The next are netstat and ps lines about it.
> tcp 0 1 192.168.0.3:52856 192.168.0.1:1990 SYN_SENT 366/kodi.bin
osmc 366 17.6 24.5 714640 184320 ? Sl 01:08 155:54 /usr/lib/kodi/kodi.bin --standalone -fs --lircdev /var/run/lirc/lircd

This is a gist of the lsof command filtering the uid 366.

Thanks for the attention!

This is a tricky one! And I don’t have a good answer for it.

You probably know this already, but just for the record. Your OSMC box is apparently trying to create a TCP socket to your router (192.168.0.1), using the router’s port 1990. It’s in SYN_SENT state which means that it has attempted to initiate the socket but the router has not (yet) replied. A quick search indicates that it will wait 20 seconds unless overridden with a parameter in /etc/sysctl.conf (that’s not set in OSMC). Then the connection will fail.

I’ve run a few netstats on my box and never managed to see a SYN_SENT. If you see that one sits there for about 20 seconds, then there will no doubt be a reason for the timeout. My best guess is because the router isn’t listening on port 1990. Why Kodi is trying to contact your router on that port is something I can’t answer.

I know about the SYN_SENT. What I don’t understand is which program tries to open it in the router as It’s not the first I’ve seen it.
Another one that uses to appear also is the 443 on this foreign IP. The source is also the same kodi process. This one is permanent or that’s what I think because it’s been there since yesterday at least. I know 443 is the HTTPS port but I don’t get why would kodi try to reach any HTTPS service or web since I’m not even using any plugin to access anything.
tcp 32 0 192.168.0.3:58896 104.20.81.229:443 CLOSE_WAIT 366/kodi.bin

I assume you use trakt?

http://whois.domaintools.com/trakt.tv

Trakt is an add-on. I guess it would have been sensible to have clarifed what clean means in this case. Are there any add-ons installed?

Yes, it must be trakt. I didn’t remember that I installed it later. When I first started this post it was about another port and I didn’t have trakt yet (it was indeed a clean install). Nevertheless, thank you very much to you two and sorry about the misleading.
Though I’m yet wondering what does Kodi want to do when asking the router for opening the 1990 port…

I think (memory may be defective here!) that 1990 is used for UPnP. If you don’t use UPnP then you can try disabling it in Kodi and see if the connection is no longer present (may need a reboot or kodi restart).

If it is then I suspect it is keeping a link open for “advertising it’s services”.

UPNP is UDP1900 I believe.

Doing a little looking around and it seems that UPnP has evolved to use a number of ports depending on who configured it!

1990 is mentioned quite often in the context of Cisco/Linksys routers offering UPnP

It also seems that it is used by Plex (although that seemingly uses many many ports!) Is there a Plex add-on installed?

Not at all. I don’t have any Plex, either server or client.

It’s an interesting read.

A quick search did show a few hits containing 1990 and WFADevice.xml, so there seems to be plausible link there.

The first post in this thread might also shed some light on what happened:

In particular we issue an SSDP query on port 1900 and get back repsonse links of:

http://192.168.1.1:1990/wfadevice.xml
http://192.168.1.1:49152/igddevicedesc.xml

But when we query these the AP/Router responds with a 404 page not found error.

SSDP query is for Plug and Play devices.

Edit: the poster then says:

We are configuring port forwarding on AP & Routers from mobile devices so the end user does not have to configure their router manually.