What's the HTTP session to the.ccsleeds.co.uk about?

[baslking]

My 411slim constantly has an HTTP session to Synology's web hoster established, anybody know what this is about? I can imagine polling for updates, but constantly established seems strange to me.

From the busybox shell I get:

myhostname>netstat |grep leeds
tcp 0 0 myhostname:49878 31-6-72-106.the.ccsleeds.co.uk:http ESTABLISHED


Ideas anyone?

BTW This is DSM 4.0 Beta

[maxxfi]

Can you try to use "netstat -n" (so it shows IP instead of hostnames) and grep e.g. for tcp ?
It's such bizarre domain that I wonder if it's some DNS quirks.

[gulbrich]

I have the same thing on my system / don't know if it's related to the ddns register for the cloud function. Not anything going on but seems to have more traffic than expected.

[gulbrich]

If you go to the site (31.6.72.106) you get this:

It works!
This is the default web page for this server.

The web server software is running but no content has been added, yet.

[kinisio]

Same problem

tcp 0 0 192.168.1.3:50317 31.6.72.107:80 ESTABLISHED 6980/synorelayd
tcp 0 0 192.168.1.3:41486 31.6.72.109:22 ESTABLISHED 13578/ssh

the big problem is the SSH....

I think is related to the CloudStation


the ip address 31.6.72.X are property of http://www.ccsleeds.co.uk/

[danielp]

Hi,

The the.ccsleeds.co.uk is the ISP in UK that hosts our server for ezCloud, Cloudstation, Push Notification, and other associated services connected with DSM4.0.
If you wish to use our DDNS service or any of the above mentioned, you will need to allow this connection.

Thanks for your feedback.

[maxxfi]

Thank you danielp.
I hope that piece of information is going to be included in all Synology documentation (manuals and wiki).

[koller]

Hi, Thanks for the information danielp.

I had a very long night before I have found this topic. I thought bad guys are using my box. It would be really nice to mention this in the documentation and even on the settings page. As I've seen an ssh session originated from the box, some new entries in the known_hosts, etc...
Maybe Synology could save a few hours to others.

BTW, Why there's no lsof on the box by default?

And do you know if the connections to hinet.net IPs are also part of the game?

PkgSynoMa 8738 root 4u IPv4 26415 0t0 TCP MYSYNO:35021->59-124-41-245.HINET-IP.hinet.net:http (ESTABLISHED)

[maxxfi]

And do you know if the connections to hinet.net IPs are also part of the game?

PkgSynoMa 8738 root 4u IPv4 26415 0t0 TCP MYSYNO:35021->59-124-41-245.HINET-IP.hinet.net:http (ESTABLISHED)

I think they are also from Synology, although I cannot say for sure.

- 59-124-41-245.HINET-IP.hinet.net has IP 59.124.41.245
- download.synology.com has IP 59.124.61.242 and if you do a reverse query on dig/nslookup for that IP you see that it also belongs to hinet, which BTW is a major ISP in Taiwan, Synology home-base (59-124-61-242.HINET-IP.hinet.net)