[Common Man]

I am wondering if the version of Kodi from the PackMan repository for OpenSuse is infected with virus/malware.

http://packman.links2linux.org/package/kodi/797262

This is a well-respected and recommended repository for linux binaries on OpenSuse. It would be impractical to run any OpenSuse machine without this repository.

Or worse, the Kodi GIT source-code itself has been compromised.

I noticed yesterday after a system update that devices on my network were having trouble with network connectivity. I have a 30mbps downstream and 6mbps upstream connection.

The speedtest from those devices were showing full download bandwidth but interrupted upstream bandwidth.

I isolated it to the machine running Kodi in my network.

Running iftop on that machine showed connections out to all kinds of internet hosts. Stopping Kodi stopped these connections and the bandwidth came back to the other machines.

I thought perhaps there was a rogue add-on or a runway script. Removed all add-ons from the home directory .kodi/add-ons and the problem persisted.

So I deleted the entire kodi installation, and the .kodi directory and re-installed Kodi.

Starting Kodi came up with the default UI and built-in default screen, etc., but the outgoing connections and bandwidth saturation happened again right at the first run!

The log of this fresh first start is at
https://pastebin.com/DKeWdqhr

I have not enabled debug because I didn't have any settings to change with a fresh run and did not want to keep running it with this suspicious behavior to change this setting from the UI.

Shutting down Kodi stops these connections to various IP addresses and some generic cloud hosting machines on the Internet.

Any ideas on what might be going on here? Can anyone with a fresh install see if such connections happen to them with any Kodi install?

Running clamav and Sophos anti-virus on the Kodi binary did not show any known infection in the binary.

PS: I also did a complete scan of that machine with both clamav and Sophos anti-virus. No infections found on the machine. Also did a rootkit check to ensure no rootkit infections existed.

[Derek]

Use the kodi PPA?

If that dosent have your linux flavour you should use whatever Kodi recommends for you or use one of the scrips and compile yourself.

Do a port scan with it open and with it closed see if theres anything dodgy but i'd just bin it anyone could tapper in a repo not controlled by kodi.

[Common Man]

Some additional information on the network traffic after starting Kodi. Connections to random machines reported in OP is a red herring. Those are ntp sync packets from ntp pooling and does not appear to be caused by Kodi.

There are some types of unusual traffic that is generated and continues when fresh Kodi 17.1 is started and is idle.

LLMNR traffic to hosts on the network

224.0.0.252:llmnr => 192.168.200.100:51435 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:59105 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:59909 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:49743 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:59710 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:55432 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:62065 0b 0b 0b
<= 0b 88b 22b
224.0.0.252:llmnr => 192.168.200.100:54197 0b 0b 0b
<= 0b 88b 22b

The 192.168.200.100 is a Windows 10 machine on the network. This flood of llmnr traffic happens when Kodi is started on the Linux machine on the same network. Not sure why. This is part of what affects the (but only the outgoing) bandwidth on the Windows 10 machine (which has nothing to do with Kodi usage). Not sure why starting Kodi results in this packet storm.

This storm continues for up to a minute after Kodi is shutdown and then subsides.

SSDP traffic to gateway

homeServer:60723 => 192.168.200.1sdp 0b 0b 103b
<= 0b 0b 1.02Kb
homeServer:60727 => 192.168.200.1sdp 0b 0b 103b
<= 0b 0b 1.01Kb
homeServer:60725 => 192.168.200.1sdp 0b 0b 103b
<= 0b 0b 834b
homeServer:60726 => 192.168.200.1sdp 0b 0b 82b
<= 0b 0b 268b

homeServer is the Linux machine running Kodi and 192.168.200.1 is the gateway router

While some amount of this traffic is normal, starting Kodi generates a large amount of this traffic and subsides when Kodi is shut down.

In all the cases above, it is a fresh install of Kodi with no add-ons added and no settings change of any kind. All default settings as done after first run.

[Derek]

If someone has modified kodi with some sort of script or such like ive never heard of it but anythings possiblr; stick with a PPA recommended on the site or forum.

[Common Man]

After some more experimentation, I don't think this is a virus or a malware infection.

The issue seems to be related to some weird interaction between a Windows 10 PC on the same network and the autoconf/UPnP feature of Kodi, generating a UDP packet storm with the Windows PC on the same network tying up its outgoing traffic. Does not happen with any other device on the network (Mac OS, iOS, Android).

Will do some more experimentation to see what running on the PC is having this conversation with the Kodi host when Kodi is running and which feature of Kodi may be causing this exactly.

[Derek]

Ah kodi 17.1 as default probes your network for upnp or something like that even if all network sharing is all disabled , bet its that; theres other threads about this.

[nickr]

Derek suse does not use ppas so there is no point banging on about that.

[nickr]

Try turning off upnp functionality in kodi.

[Common Man]

I turned off ZeroConf, Share my libraries and Allow remote control via UPnP. AirPlay is turned off by default.

Still there are packets when Kodi is started for service discovery and local link host resolution.

The above settings seem to control if Kodi does any advertising of its services to others but there does not seem to be a setting that says don't go looking for (UPnP or something) services pro-actively from others on the network. If I am not wrong on this and the current settings are labeled correctly, there should be such a setting.

Still not sure why it seems to get into this argument with the Windows 10 PC to disrupt the connectivity on the PC.

With increasing proliferation of IoT devices at home, there may need to be some network discipline with apps like Kodi. An assumption of what else might be on the network will keep changing (it is not just storage sharing or media UPnP any more) and such conversations may get worse.

I will take a look at other threads on this network traffic as alluded to above.