Huge tcp traffic from internet to my freenas, what is this?

[lightman]

Hello
I have been using freenas for about a year without problem, yesterday i notice my internet connection was slow as hell and decide to investigate.

Capturing traffic on my mikrotik router (torch) i can see that one session coming from tpa1-01.cdn.scaleengine.net (TCP packets, ip:104.156.60.49 ) where using 100% of my bandwidth (incoming, i mean from internet to freenas)

What is this?, i have no idea what is scaleengine, i don't have any jail or any service that would require my freenas to connect to the internet and download a huge amount of data from it.
I only use it for SMB, i never upate it.

I created a forward rule in the mikrotik firewall to block traffic from internet to the freenas and that's it, but, why does it happens?, any ideas?, it really concern me that freenas could be doing something it does not supposed to be doing.

Data: Freenas 9.3-STABLE x64 (Boots from a 16GB flash drive)
16GB RAM, 2x 3TB WD RED (SATA)
intel pro 1000GT network card.
AM1M-S2H (gigabyte) motherboard with AMD 5350 APU.

rig works fantastically fine as always, just this traffic that concerns me.
I should probably had investigated more like what port was coming from but honestly, it was late and i didn't think of it at the time :(

 

[Robert Trevellyan]

i have no idea what is scaleengine

According to their website, "ScaleEngine is the video content delivery network dedicated to your content."

 

[lightman]

Hi!, yes I saw that site but not idea what is doing with my freenas!, is the first time i heard about this site, i don't do any video content, i don't host any services of any kind, is my home network, all my corporate servers are at my office, this freenas is in my house, i just check and freenas tried again to connect to the internet to another IP but same site scaleengine.net :( (obviously, it is now blocked by the firewall rule of the router, but it still, why is it trying to?)

 

[SweetAndLow]

So you have any plugins? Tell us more about what you have configured.

 

[lightman]

So you have any plugins? Tell us more about what you have configured.

Hi!
No, no plugins i only configured CIF, to access from my linux and windows machines, everything else is disabled, hyper basic functionality

 

[bestboy]

That's frightening. Did you check with sockstat what process connected to that IP?

Code:

sockstat -cL -P tcp

 

[Mirfster]

Doing any rsync? Just saw this: https://bugs.freenas.org/issues/15281

 

[cyberjock]

I know the updating servers use scaleengine. But as the update files are only 300MB or so, it shouldn't take long to download that much data.