MP2 2.1.3 client network broadcast crippling other systems on network (2 Viewers)

[JSchuricht]

MediaPortal 2 Version: 2.1.3

Description
This is a strange one. About two days ago the windows 7, 8.1, 10, 2012r2 and 2016 server virtual machines that I was connected to through RDP started randomly disconnecting. System interrupts and svhost were using 100% of the threads in every VM. I also found a strange ~140-200mbs receive network traffic on every VM and every physical windows system that showed up in task manager but not resource monitor. The physical systems did not have high CPU usage. The inbound network traffic was not IP bound, I could run just IP4 or IP6 and use a random address from a different subnet while still showing 140mbs receive. There was no traffic through the router corresponding to this and disconnecting from the internet made no difference.

The source I traced the traffic to was a single i7 7700T Windows 10 1709 box running only MP2 2.1.3 and a antivirus program that had been sitting idle. On this system, MP2-Client.exe was maxing out all 8 threads and sending network traffic out of both wired and wireless interfaces. Terminating MP2-Client instantly fixed every system on the network. Restarting MP2 did not bring back the issue so its going to be tough to test anything.

edit: This also seems to have been the cause of a smart TV that was rebooting itself during the same time frame.

Steps to Reproduce:
unsure at this point
MP2 client was used to watch a TV show about 15 hours before issue was detected then left idle showing the season for the TV series that had been played.

 

[JSchuricht]

The bug just came back. This time it originated from a different MP2 client. Configuration of the client is nearly identical with 2.1.3 and Windows 10 1709, only difference is the size of the SSD and brand of memory. Uptime on the client was about 1.5days. I was in a hurry to get everything back up but I did manage to get a screenshot showing MP2 generating traffic on a multicast IP.

 

[JSchuricht]

Just happened again on the MP2 client that had the issue the first time. This time I had enough time to turn on debug logging. The client is running on windows 10 1803 now vs 1709 last time.

 

[ge2301]

Can you try to deactivate IPv6 in MP2, this was causing problems with some people. Apart from that I’m not sure what could cause this. I have same version of Windows 10 and no issues.

 

[Lehmden]

Hi.
Had a quick look at your latest logs. In general I can see 2 different issues. First, the RSS plugin of the MP2 client tries to connect to some activated news server but can't and the other issue is related to UPnP. It seems as if the client has issues reaching the server as the UPnP connection could not be established.

Service 'schemas-team-mediaportal-com:device:MP2-Server:1.schemas-team-mediaportal-com:serviceerverSettings:1' is not connected to a UPnP network service

While the first could be caused due to a temporary internet "hickup" the second one is based on some local network issues. But what exactly went wrong, I don't know.
The first step to solve this is as mentioned above,.. try to disable IPv6 inside the (all) MP2 client. If this did not solve the issue, it would be interesting if the time frame until the issue appears always is similar.
Also the client is sending the network traffic the main issue nevertheless could be located at the server that is not reachable via UPnP at the time when this issue happens... But this only is a guess as we also need the server logs to verify this.

 

[JSchuricht]

Thanks. IP6 is now disabled on both clients. RSS I am guessing is configured under managed feeds. Both clients are default with the feeds screenshot below. I tried removing all the feeds but when the last one is removed they all reappear. So for now they are limited to just the MediaPortal feed. Also, server logs attached.

 

[JSchuricht]

Looks like this is becoming a monthly thing or at least once every two months for each client. It still managed to get me by surprise, spent way too much time thinking a NIC was going bad on another system. I finally took a break to watch TV when the network connected TV started shutting off and rebooting I realized what was happening. Like before, terminating the media portal process on the client sending the traffic brought everything back to normal.

I added the clients to my monitoring system so I have an exact start time of the network traffic

Log files from 15:15 are the server, 05:23 are the client that was sending the traffic.

The mediaportal client and its network port on the switch.

G11 is the mediaportal client with inbound traffic. Nearly every port on every switch gets nailed with the same broadcast traffic.

Log files from a server I was troubleshooting at the time. Maybe they will shed some light on the mystery traffic.

 

[JSchuricht]

Just had the first repeat that didn't take a month to show up. It was the same client that had an issue yesterday.

MP2 client sending traffic. Terminating this client fixes the entire network.

Other MP2 client receiving traffic. Terminating this client made no difference in traffic or CPU load.

 

[JSchuricht]

Something is really wrong with this client, it just happened again.

 

[BlueMax1916]

Hi,

strange, do you know where this traffic goes to? Do you have TCPView to check?

Cheers

Blue Max