[BUG] Suspicious Data Usage #87
Comments
|
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is there an existing issue for this?
Current Behavior
I noticed unusually high network utilization coming from my server. With some digging, I was able to narrow it down to it originating from the syncthing container. I have updated the container to the latest and after restarting the server and the container, the suspicious data comes back. So, what makes it suspicious? I have nothing configured to use syncthing that lives outside of my LAN, and yet syncthing was pulling ~10mbps (give or take 3mbps) consistently through my WAN connection. It would do this from a seemingly random IP:port combination. If I block one in my firewall then it would keep attempting the connection periodically before swapping to a new IP:port combination. It was always tcp traffic with the destination port (external to my lan) being 443.
Some example IPs that were connected to are: 45.41.204.213, 169.150.197.139, 103.214.71.33, 107.152.39.18.
The ports were always in the 40k-55k range, from what I could tell.
I do not know enough to know if this means the container is compromised, but I will not be running it on my network anymore.
Expected Behavior
It should not be transferring large amounts of data with suspicious WAN connections.
Steps To Reproduce
Run the container with this docker compose, where the "external" network is a bridge network.
Use your network observation tool of choice to see a spike in traffic attempting to traverse your WAN interface. I used Torch on my mikrotik router.
Environment
CPU architecture
arm64
Docker creation
services: syncthing: image: lscr.io/linuxserver/syncthing container_name: syncthing environment: - PUID=1000 - PGID=1000 - TZ=America/Chicago volumes: - /home/ubuntu/external/config/syncthing:/config - /home/ubuntu/external/media:/data - /home/ubuntu/external/config:/serviceConfigs ports: - 8384:8384 - 22000:22000 - 21027:21027/udp restart: unless-stopped networks: - frontend labels: - traefik.enable=true - traefik.http.routers.syncthing.rule=Host(`syncthing.fox.local`) - traefik.http.routers.syncthing.entrypoints=web - traefik.http.services.syncthing.loadbalancer.server.port=8384 networks: frontend: external: trueContainer logs
The text was updated successfully, but these errors were encountered: