Transmission scans own IP address ports

[penguindies]

Whenever a torrent is active, Transmission would scan the ports of its own IP address, usually starting with 60000 and climbing, but I've seen it scan from 30000 onward from time to time.

Reproducible? Yes

System information:

OS X 10.6.3 (10D537) -- also 10.5 through 10.6.2 3Com ADSL wireless router 3CRWDR101A-75 -- any firmware, from earliest to latest Transmission versions: 1.93 (10621) -- also 1.92, 1.91

[User294]

Just to let you know:

In TCP/IP, when connection is made, you can think of it as if it was pipe which connects IP:port endpoint of source ("client", initiating connection) to IP:port endpoint of destination ("server", accepting connections).

Here we go. When application accepts connection, it's port is known as listening port and that's what you specify in settings, etc because it is quite important.

However, Transmission also should make some outgoing connections as well. And it's obvious there should be some local IP:port pair used. Most of times it is not really important which local ports would be used for outgoing connections. So, most of apps just do not care and simply allow OS to auto-assign those local ports for outgoing connections. Most of OSes would number those ports sequentially. Usually only ports greater than 1024 could be used for this purpose (and OS may have it's own idea which ranges to use). And while it is possible for application to use specific ports as local end of outgoing connection, common practice is to let OS to manage these ports. Then you would see how local ports are used in sequental order due to outgoing connections being made. Btw, apps like web browser can do something similar as well when making several outgoing connections, etc.

While I'm not a developer, I would be evil enough to try to close this bug as "invalid" because it appears to be not a bug, actually. So this would hopefully offload dev's from dealing with stupid things. Feel free to reopen bug and/or blame me if disagree with such resolution and believe I'm wrong.

[penguindies]

This behavior isn't exhibited by other programs or BitTorrent? clients. Transmission seems to be trying to communicate with itself, for example:

11:17:43 LAND x.x.x.137, 51874->> x.x.x.137, 50807

11:17:18 LAND x.x.x.137, 51874->> x.x.x.137, 50765

11:16:03 LAND x.x.x.137, 51874->> x.x.x.137, 50644

11:14:57 LAND x.x.x.137, 51874->> x.x.x.137, 50523

11:14:55 LAND x.x.x.137, 51874->> x.x.x.137, 50517

11:14:07 LAND x.x.x.137, 51874->> x.x.x.137, 50423

11:12:57 LAND x.x.x.137, 51874->> x.x.x.137, 50296

11:09:48 LAND x.x.x.137, 51874->> x.x.x.137, 49881

11:07:57 LAND x.x.x.137, 51874->> x.x.x.137, 49622

11:06:54 LAND x.x.x.137, 51874->> x.x.x.137, 49491

11:04:59 LAND x.x.x.137, 51874->> x.x.x.137, 49232

11:02:34 LAND x.x.x.137, 51874->> x.x.x.137, 65262

10:59:46 LAND x.x.x.137, 51874->> x.x.x.137, 64900

10:57:19 LAND x.x.x.137, 51874->> x.x.x.137, 64593

10:55:50 LAND x.x.x.137, 51874->> x.x.x.137, 64400

10:55:38 LAND x.x.x.137, 51874->> x.x.x.137, 64373

10:53:48 LAND x.x.x.137, 51874->> x.x.x.137, 64135

10:52:04 LAND x.x.x.137, 51874->> x.x.x.137, 63899

10:48:06 LAND x.x.x.137, 51874->> x.x.x.137, 63427

10:47:08 LAND x.x.x.137, 51874->> x.x.x.137, 63298

10:43:57 LAND x.x.x.137, 51874->> x.x.x.137, 62958

10:42:55 LAND x.x.x.137, 51874->> x.x.x.137, 62849

10:42:24 LAND x.x.x.137, 51874->> x.x.x.137, 62790

10:36:57 LAND x.x.x.137, 51874->> x.x.x.137, 62106

10:33:04 LAND x.x.x.137, 51874->> x.x.x.137, 61655

10:30:08 LAND x.x.x.137, 51874->> x.x.x.137, 61265

10:27:10 LAND x.x.x.137, 51874->> x.x.x.137, 60897

10:22:11 LAND x.x.x.137, 51874->> x.x.x.137, 60276

10:20:18 LAND x.x.x.137, 51874->> x.x.x.137, 60027

10:15:19 LAND x.x.x.137, 51874->> x.x.x.137, 59411

10:13:20 LAND x.x.x.137, 51874->> x.x.x.137, 59150

10:12:54 LAND x.x.x.137, 51874->> x.x.x.137, 59089

10:11:59 LAND x.x.x.137, 51874->> x.x.x.137, 58969

10:11:50 LAND x.x.x.137, 51874->> x.x.x.137, 58949

10:10:54 LAND x.x.x.137, 51874->> x.x.x.137, 58837

10:09:54 LAND x.x.x.137, 51874->> x.x.x.137, 58725

10:09:50 LAND x.x.x.137, 51874->> x.x.x.137, 58716

10:09:16 LAND x.x.x.137, 51874->> x.x.x.137, 58643

10:09:10 LAND x.x.x.137, 51874->> x.x.x.137, 58630

[charles]

Hi penguindies,

• What do I need to do to observe / monitor this behavior myself?

• Does the problem persist if you disable DHT?

• Does the problem persist if you disable port forwarding?

• Does the problem persist if you disable connections from the web client?

[penguindies]

Hi charles, thanks for the help.

• What do I need to do to observe / monitor this behavior myself?

The error messages appear in the router's security log, whenever Transmission acquires new peers.

This is my configuration:

• OS X 10.6.3 (10D537) - or 10.5 through latest
• 3Com ADSL wireless router 3CRWDR101A-75
• Transmission versions: 1.93 (10621)

• Does the problem persist if you disable DHT, port forwarding, web client?

Yes on all accounts. The port is manually forwarded on the router, DHT, UPnP, and web client are disabled.

[penguindies]

The issue continues with Transmission 2.00 (10766)

[x190]

FWIW, Port 137 is used by net-bios and is used for internal communication. In this case, it appears that your OS is setting up the internal ports necessary for peer connections, and what you are seeing is router to OS chatter, sorta like it's making sure each 'channel' is open between your router and the OS network interface.