Little Snitch - Thousands Of Connections

[RNAOMDCOLECLTOINOFLERTTES]

I've got 7 shared folders. Everything has been syncing for a while so everything looks good.

 

For each folder, treble checked, settings changed so that:

* Relay disabled

* Tracking server disabled

* Search LAN disabled

* Search DHT network disabled

 

Shut down and restarted BTSync. Version is 1.3.94.

So there shouldn't be any connections to anywhere since no folders have options set.

 

Yet LittleSnitch shows 4-5KB/received and 500b sent, per second, with connections to around 3000 servers with the number increasing. And it's random IP addresses, across the entire range (31.76,xxx,xxx, 77,31,xxx,xxx, etc)

 

And... interestingly, it's still able to send/receive - e.g. I start my Android device on the same network and it says 1 device online and syncs the file over I put in the shared folder.

 

So, I suspect that the settings are not being correctly applied from the GUI to the engine and it's not honouring my request for no networking.

 

Also if I change all settings so they are

* Search LAN enabled (with the rest still disabled)

 

In this mode it makes no difference, still the same number of connections.

 

 

[RomanZ]

@RNAOMDCOLECLTOINOFLERTTES

 

That's rather strange. In your case (with disabling Relay, Tracker, DHT, LAN) only next connections should stay active: UPnP or NAT-PMP, check for updates, and that's it. Plus direct connections to the predefined hosts, if any. None of them is located on 31 or 77 networks.

 

I wonder, if it is possible to make a traffic capture with wireshark so I can analyze it? It would be much better if you capture it together with debug logs.

 

Thanks!

[RNAOMDCOLECLTOINOFLERTTES]

Great; I've used little snitch to capture just the traffic from BTsync, ran the debug logs. I'll pm you a link to them.

[RomanZ]

@RNAOMDCOLECLTOINOFLERTTES

 

Thanks for the logs and packet capture, seems I've found the answer what is happening: you have a DHT turned on. All these "suspicious peers" are actually part of DHT network.

 

I suggest to do the following:

1. Make sure DHT is off for all your shares on all peers.

2. Change listening ports on all peers.