True Image 2014 making rogue connections to nas on certain ports
My router has been dropping some bad tcp packets from my laptop to my synology nas. I've traced the source of the request back to true image. I've masked the internal IP's below, but kept the ports.
TCP 192.168.1.XXX:31250 192.168.1.XXX:5000 FIN_WAIT_1
[TrueImage.exe]
TCP 192.168.1.XXX:31251 192.168.1.XXX:32469 FIN_WAIT_1
[TrueImage.exe]
Port 5000 is the default HTTP admin port for the synology, which is not configured for use (I enforce HTTPS on another port). 32469 is one of the ports serving Plex Media Server. True image should have no reason to be attempting these connections. My backup is configured to use a shared folder on the nas, but that's only 3 times a week. These connections are being attempted several times per minute all day long.
Why is it doing this? I initially suspected malware, but that has been ruled out.
True image 2014 has been nothing but a headeache for me after using several previous versions which I loved in the past. I won't get into all the issues as they are covered readily in the forums. It might be time to try another product after using Acronis loyally for the past 7 or 8 years.


- Log in to post comments

It not congestion, the router is actively dropping them on purpose. There is very little activity on the network.
Below is what is indicated in my router's log and matches the source/destination of the scan I got from netstat where it pointed to true image being the process creating them. The dropping of these is not my concern, the fact that true image is actively making these connection is to ports it has no business connecting to.
Nov 12 23:11:18 Blocked incoming TCP Ack packet from 192.168.1.XXX:11985 to 192.168.1.XXX:5000 with unexpected sequence
Nov 12 23:10:13 Blocked incoming TCP Ack packet from 192.168.1.1XXX:11973 to 192.168.1.1XXX:32469 with unexpected sequence
- Log in to post comments

What I can tell you is that in the first instance:
(TCP 192.168.1.XXX:31250 192.168.1.XXX:5000 FIN_WAIT_1
[TrueImage.exe]
TCP 192.168.1.XXX:31251 192.168.1.XXX:32469 FIN_WAIT_1
[TrueImage.exe])
The FIN indicates True Image wants to terminate the connection on the named ports.
In the second instance:
(Nov 12 23:11:18 Blocked incoming TCP Ack packet from 192.168.1.XXX:11985 to 192.168.1.XXX:5000 with unexpected sequence
Nov 12 23:10:13 Blocked incoming TCP Ack packet from 192.168.1.1XXX:11973 to 192.168.1.1XXX:32469 with unexpected sequence)
This indicates that the ACK (acknowledgement packet) sent from the named ports is of unexpected sequence meaning that the sequence number SYN (synchronization) of the packets in the TCP header of the transmission does not follow the expected numbering of the TCP routing of the transmission.
Why this is occurring I am not sure. Do note that each instance above are different ports
This indicates to me a network error is occurring that in all likelihood is hardware related. I would suspect possible ethernet cabling issues.
- Log in to post comments