It’s marked as hpvmmdata as common port usage, but I’m running clean OSMC on a RPi2 so it can’t be nothing related to HP.
Netstat displays that is being used by Kodi.bin service. When going through the tree of the service it says that is being used by /usr/lib/kodi/kodi.bin --standalone -fs --lircdev /var/run/lirc/lircd.
It’s a new installation, and I changed SSH port and every password to non dictionary ones plus I’m not seen anything strange in the logs.
Also I don’t have anything plugged on the GPIO nor I have lircd enabled by any mean and it’s always running, whether I’m using the mediacenter or not, and never using any IR device. It usually takes about 15 % of CPU usage an 20 % of RAM.
Can someone help me or at least orient me?
So now it disappeared, but another one apeared on the port 52856 (I guess thats a random one) and outputing to the router 1990 port. I’ve looked for it on the Internet and it’s usually used for “Cisco STUN Priority 1 port”. But as I don’t have any Cisco hardware it must be another thing, that I don’t really know.
The next are netstat and ps lines about it. > tcp 0 1 192.168.0.3:52856 192.168.0.1:1990 SYN_SENT 366/kodi.bin osmc 366 17.6 24.5 714640 184320 ? Sl 01:08 155:54 /usr/lib/kodi/kodi.bin --standalone -fs --lircdev /var/run/lirc/lircd
This is a gist of the lsof command filtering the uid 366.
This is a tricky one! And I don’t have a good answer for it.
You probably know this already, but just for the record. Your OSMC box is apparently trying to create a TCP socket to your router (192.168.0.1), using the router’s port 1990. It’s in SYN_SENT state which means that it has attempted to initiate the socket but the router has not (yet) replied. A quick search indicates that it will wait 20 seconds unless overridden with a parameter in /etc/sysctl.conf (that’s not set in OSMC). Then the connection will fail.
I’ve run a few netstats on my box and never managed to see a SYN_SENT. If you see that one sits there for about 20 seconds, then there will no doubt be a reason for the timeout. My best guess is because the router isn’t listening on port 1990. Why Kodi is trying to contact your router on that port is something I can’t answer.
I know about the SYN_SENT. What I don’t understand is which program tries to open it in the router as It’s not the first I’ve seen it.
Another one that uses to appear also is the 443 on this foreign IP. The source is also the same kodi process. This one is permanent or that’s what I think because it’s been there since yesterday at least. I know 443 is the HTTPS port but I don’t get why would kodi try to reach any HTTPS service or web since I’m not even using any plugin to access anything. tcp 32 0 192.168.0.3:58896 126.96.36.199:443 CLOSE_WAIT 366/kodi.bin
Yes, it must be trakt. I didn’t remember that I installed it later. When I first started this post it was about another port and I didn’t have trakt yet (it was indeed a clean install). Nevertheless, thank you very much to you two and sorry about the misleading.
Though I’m yet wondering what does Kodi want to do when asking the router for opening the 1990 port…
I think (memory may be defective here!) that 1990 is used for UPnP. If you don’t use UPnP then you can try disabling it in Kodi and see if the connection is no longer present (may need a reboot or kodi restart).
If it is then I suspect it is keeping a link open for “advertising it’s services”.