Salta al contenuto principale

True Image 2014 making rogue connections to nas on certain ports

Thread needs solution

My router has been dropping some bad tcp packets from my laptop to my synology nas. I've traced the source of the request back to true image. I've masked the internal IP's below, but kept the ports.

TCP 192.168.1.XXX:31250 192.168.1.XXX:5000 FIN_WAIT_1
[TrueImage.exe]
TCP 192.168.1.XXX:31251 192.168.1.XXX:32469 FIN_WAIT_1
[TrueImage.exe]

Port 5000 is the default HTTP admin port for the synology, which is not configured for use (I enforce HTTPS on another port). 32469 is one of the ports serving Plex Media Server. True image should have no reason to be attempting these connections. My backup is configured to use a shared folder on the nas, but that's only 3 times a week. These connections are being attempted several times per minute all day long.

Why is it doing this? I initially suspected malware, but that has been ruled out.

True image 2014 has been nothing but a headeache for me after using several previous versions which I loved in the past. I won't get into all the issues as they are covered readily in the forums. It might be time to try another product after using Acronis loyally for the past 7 or 8 years.

0 Users found this helpful

It sounds like the application is polling the network. It should not be doing that I don't think. Could be that it is looking for a task completion bit response from the NAS, router or other network device. You indicate that your router is dropping bad packets that are traceable back to True Image. Generally TCP packet loss is the result of network congestion. There can be many causes. The link below to a Wiki page on the subject may shed some light on the problem for you. I think the issue is not that of a problem with True Image but of some other problem in your network.

http://en.wikipedia.org/wiki/Packet_loss

It not congestion, the router is actively dropping them on purpose. There is very little activity on the network.

Below is what is indicated in my router's log and matches the source/destination of the scan I got from netstat where it pointed to true image being the process creating them. The dropping of these is not my concern, the fact that true image is actively making these connection is to ports it has no business connecting to.

Nov 12 23:11:18 Blocked incoming TCP Ack packet from 192.168.1.XXX:11985 to 192.168.1.XXX:5000 with unexpected sequence
Nov 12 23:10:13 Blocked incoming TCP Ack packet from 192.168.1.1XXX:11973 to 192.168.1.1XXX:32469 with unexpected sequence

What I can tell you is that in the first instance:
(TCP 192.168.1.XXX:31250 192.168.1.XXX:5000 FIN_WAIT_1
[TrueImage.exe]
TCP 192.168.1.XXX:31251 192.168.1.XXX:32469 FIN_WAIT_1
[TrueImage.exe])
The FIN indicates True Image wants to terminate the connection on the named ports.

In the second instance:
(Nov 12 23:11:18 Blocked incoming TCP Ack packet from 192.168.1.XXX:11985 to 192.168.1.XXX:5000 with unexpected sequence
Nov 12 23:10:13 Blocked incoming TCP Ack packet from 192.168.1.1XXX:11973 to 192.168.1.1XXX:32469 with unexpected sequence)
This indicates that the ACK (acknowledgement packet) sent from the named ports is of unexpected sequence meaning that the sequence number SYN (synchronization) of the packets in the TCP header of the transmission does not follow the expected numbering of the TCP routing of the transmission.

Why this is occurring I am not sure. Do note that each instance above are different ports

This indicates to me a network error is occurring that in all likelihood is hardware related. I would suspect possible ethernet cabling issues.