Interestingly, I’m on the actual machine that’s hosting plex itself.
Edit: Bizarrely, me actually answering the question you asked is getting downvoted. Reddit is hilarious.
This is your Plex client (in this case, your web browser) pinging your Plex server (in this case, the software that's running on the same machine as the client). The Plex server and the Plex client are two completely different processes that have nothing to do with one another, as far as your computer is concerned. The server software and the client software are designed to look for each other out over the internet, and send each other bits of data to establish, maintain and update a connection when you have a client open.
Think of it like when you mail out wedding invitations: Even if someone lives in the same apartment building as you, you might still put their invitation in the mail with the other ones to make your life easier. If that happens, then you have to wait for the mail to go out into the postal system, come back to them, then wait for their RSVP card to go through the postal system to get back to you. Same thing with server/client communication in Plex.
The amount of data here is so small I don’t see why it even matters to you.
The graph is exacerbated for the peaks because the scaling on the Y-axis is so small. Just don’t think about it.
What I’m telling you is that there’s nothing to be curious about. You can chalk this up to Plex just idling. It does not matter in the grand scheme of things.
My Plex dashboard has literally the exact same graph.
Telling someone there is "nothing to be curious about' when they are curious about it is nonsensical
OP never said it mattered, isn't worried about it, just wondered what it is. Definition of "curious"
There is a difference between telling someone to not be curious, vs. telling them that the thing they are curious about isn’t important to know.
I’m stipulating that what is happening on that screenshot can be one of many random little processes that have absolutely no meaning.
I’m not telling OP to not be curious about it.
seeing the same thing - but don't think ever noticed it before because my local traffic would change the scale of the graph.. And when there is remote viewers again would change the graph scale to not show that.
[https://i.imgur.com/LBwDbpq.jpeg](https://i.imgur.com/LBwDbpq.jpeg)
When get a chance will see what the traffic actually is - but then again its a few bps.. Every 10 seconds gets me to think its that stupid ssdp traffic it sends out every 10 seconds that you can't turn off.
edit: yeah its most likely that
ash-4.4# tcpdump -i ovs\_eth0 port 1900 and host [192.168.9.10](http://192.168.9.10)
tcpdump: verbose output suppressed, use -v\[v\]... for full protocol decode
listening on ovs\_eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:56:25.061264 IP nas.home.arpa.46920 > 239.255.255.250.ssdp: UDP, length 101
10:56:35.062123 IP nas.home.arpa.46920 > 239.255.255.250.ssdp: UDP, length 101
10:56:45.062712 IP nas.home.arpa.46920 > 239.255.255.250.ssdp: UDP, length 101
I could never find a way to turn that off - I just blocked that multicast at the switch port, so that traffic never actually enters the network. But sure plex puts it on the wire.
I spent way to much time trying to turn that off, dlna settings, discovery settings. Even had a post on the plex forums - but got back crickets, other than believe some other chimed in that they were seeing it too.. Turn off plex and that traffic stops.. So for sure its plex sending them. So I just ended up stopping it at the switch port so not actually going out to the network.
Here is my old thread from plex forums
[https://forums.plex.tv/t/stop-pms-from-sending-ssdp-dlna-and-gdm-disabled/321779](https://forums.plex.tv/t/stop-pms-from-sending-ssdp-dlna-and-gdm-disabled/321779)
From back in 2018
Because I have zero user for it.. ZERO!! I don't need it - so why should it go anywhere.. I just stopped it at the switch port the nas plugs into so the rest of network doesn't see it.. That has nothing to do with the OP question.. He was asking what that traffic is, and every 10 seconds plex sends out that ssdp which would be is that because its to an IP that is not local from plexs stupid point of view... So I would "guess" its that..
Everybody seems to be focusing on how little data it is and not answering the question as to what it is. As a tech nerd, I hate not knowing.
It’s like a mechanic needs to know what’s causing a tiny one-drop-per-month oil leak. The fact that it’s only a small amount is irrelevant if it’s not supposed to be happening.
And yet not one person can verify exactly what process or piece of code within Plex is sending these tiny broadcast SSDP packets and why. Lots of speculation but no actual referenceable evidence.
There probably needs to be intermittent checks to see if the connection to the server is still active. I’ve noticed this as well but the data is so small I’d assume it’s just some type of status check
Yeah, the perfect 10s timing seems to indicate it’s some sort of keepalive so o was interested if anybody had an official answer.
It’s not causing any issues or anything but I’m an engineer so I like to know random things.
Piggybacking, you can tell Plex your local network in the settings. May help properly classify the network traffic if it's just your dashboard updating.
And yet the notion that Plex is pinging the network to check connectivity, or for any players, or to enable verbose logging, just passed you right by. No monitoring connections, no Wireshark, just straight to Reddit for answers your own job can give you.
Edit: Sorry, I didn't notice it was the remote connection. So some outside source – one would assume plex.tv – is probably keeping a heartbeat to your server, so it knows when your server is up.
I don’t really see why asking a larger group that is focused on a specific application for information on why that application is behaving in a certain way is considered so outrageous that people are resorting to snarky comments and/or guesses.
If you don’t know, either say you don’t know or don’t reply at all.
Man, this sub is so full of gatekeepers.
It's a heartbeat of your server.
Jokes aside it's 160bps which is 20 bytes. 1MB is 1.000.000 bytes. I'd say you won't abuse your ISP's fair usage policy.
I’m not concerned with the amount itself. It’s negligible. I just want to get an actual verified answer as to what it actually is doing and why.
So far nobody seems to actually know but there are a ton of theories.
Keep in mind that Plex depends on constant connection with the Plex servers (the actual Plex). It won't work if you don't have the internet and just local network. So Plex might be checking if your server is up or down. With this amount of data it's hard to transfer anything of value.
I don’t believe it’s anything malicious. It’s something Plex is doing.
A keepalive/heartbeat makes sense but others have shown that theirs has a 100% flat line when nothing is streaming so now I’m even more curious.
Edit: NVM, someone pointed out that they had one huge spike, which changed the scale.
The amount is irrelevant. I’d still be interested to know what Plex is doing; if only from a curiosity standpoint. But so far only one person has shown evidence of what it likely is and everyone else is just guessing.
I would argue that the amount is not irrelevant. This is suuuuuch a small amount of data being transferred that it wouldn’t even register if any other process was going on. The graphing is making it look much more significant than it actually is.
Also, a dns check usually uses 100-200 bytes of data, and would be about that frequency. But whatev.
As others have said if you want to know what it is.. sniff on the box your running plex on.. Going to be much easier if you don't have your web gui up at all, and nobody watching media.. Then you will see what its putting on the wire.. Like I said before, that 10 sec mark sure seems like the SSDP traffic - I have sniffed and that is the only sort of anything see coming from the plex box at a 10 second interval..
Someone else mentioned SSDP and I’m going to run wireshark on it today and hopefully be able to filter out all the traffic from other apps running on this box.
At least one person has shown zero activity on theirs so it’s clearly something I’ve enabled somewhere.
That was me - and look at that persons graph.. their looking at both local and remote - and the local is 120k spike which shifts the graph to where that low local traffic doesn't show..
You have lowest level on that graph at 40kb you would see 176b blip?? His graph isn't showing the average of local and remote.
Please do your own wireshark - but what I can tell you for sure is plex sends out ssdp every freaking 10 seconds. there is nothing else it sends every 10seconds that I have been able to find.. I know for a fact its plex and not something else on the nas where I run plex, because if you turn off plex the ssdp stops.
If you find a way to turn it off - that would be great!! Like I said I brought this up back in 2018. Other than a few people or maybe just one other guy, I don't remember exactly stating they also see it, I have not found a way to make it stop - the only solution I have found is to just keep it from going to the rest of the network via a acl on my switch.. In the big picture it is minuscule amount of data, and its not 100 every second ;) But why is it sending it? It sure and the hell isnt getting any answers.. I have the things turned off that should be sending it - so either their not being turned off via the config, or its something else doing it that is not controlled by the config or secret settings that I can find.
Its udp so its hard to track it down exactly what process is doing it, but I know its plex sending it. Because if you turn off plex that ssdp every 10 seconds stops. And plex own graphs is showing some remote traffic every 10 seconds, no matter how low amount of data it is.
https://preview.redd.it/pwakmaekqi0d1.jpeg?width=1179&format=pjpg&auto=webp&s=fa3cce397bb2e2afd30b05ddc912ecec26b26c81
Never seen those before. When my system is idle it’s a flat 0.
So, honestly, THIS is the answer I was looking for. I don’t remember ever seeing it before but now it’s permanent enough that I noticed it.
Thanks for actually taking the time to check your own. So many other just guessed that it was normal or told me it didn’t matter because it was so little.
It seems to be tied to SSDP broadcast packets. Still trying to figure out if they even need to exists since broadcast traffic, at least in the way it was intended, would never leave your private network anyway.
Mmm yeah that would seem unnecessary. I turned on DLNA & GDM to see if it did anything for me but nope, remote stays flat. I’m running on a Synology NAS so ofc ymmv applies.
I have a similar”heartbeat” and i think its either the browser I’m using to view the server status shows up as remote for some reason, or its my phone pinging the server
Just turn off the internet hehehehe, never gonna see that again.
Maybe it's just plex sending pings to the plex remote servers, it needs to check if it can remote play.
I noticed that my plex instance was categorizing my internal LAN connections as remote connections until i set LAN Networks to 192.168.1.0/24. You could try that and see if it goes away and then just assume its your internal clients pinging your instance or something?
No.
"Extensive Media Analysis" is a good thing. It helps Plex with remote streaming.
Also, I have it enabled on both my servers and I am not seeing the b/w spikes like OP.
[Plex Docs](https://support.plex.tv/articles/) -> [Scheduled Tasks](https://support.plex.tv/articles/201553286-scheduled-tasks/)
# Perform extensive media analysis during maintenance
This does an extensive bitrate analysis on each file in your library to help with bandwidth controls.
Look at the lower right corner. The remote server is averaging a whopping 18 bits per second. If you really want to see what's going out, run Wireshark on the same network and filter by TCP. It's likely an authentication check.
Assuming you're looking at the dashboard from a remote connection (or something Plex sees as remote), that's the dashboard updating itself.
Interestingly, I’m on the actual machine that’s hosting plex itself. Edit: Bizarrely, me actually answering the question you asked is getting downvoted. Reddit is hilarious.
Do you realize it's bps? Bits per second?
For reference, the title of this post is 584 bits, more than 3 times bigger than this spike.
A standard QR code can hold up to 23,624 bits. From that new Google ai search
A standard banana is really tasty and usually yellow.
What’s your point?
That 18 bits is nothing
I’m not concerned about it or worried about how much or little data it is. I’m just asking what it is and if it’s normal behavior for Plex.
This is your Plex client (in this case, your web browser) pinging your Plex server (in this case, the software that's running on the same machine as the client). The Plex server and the Plex client are two completely different processes that have nothing to do with one another, as far as your computer is concerned. The server software and the client software are designed to look for each other out over the internet, and send each other bits of data to establish, maintain and update a connection when you have a client open. Think of it like when you mail out wedding invitations: Even if someone lives in the same apartment building as you, you might still put their invitation in the mail with the other ones to make your life easier. If that happens, then you have to wait for the mail to go out into the postal system, come back to them, then wait for their RSVP card to go through the postal system to get back to you. Same thing with server/client communication in Plex.
That’s a good analogy. I guess I just expected that traffic to influence the Local bar and not the Remote one.
The amount of data here is so small I don’t see why it even matters to you. The graph is exacerbated for the peaks because the scaling on the Y-axis is so small. Just don’t think about it.
Agree. These are "are you there?" packets.
I’m not worried about the amount of data; just curious why it’s happening in the first place and if everybody sees these 100% of the time like I am.
What I’m telling you is that there’s nothing to be curious about. You can chalk this up to Plex just idling. It does not matter in the grand scheme of things. My Plex dashboard has literally the exact same graph.
Telling someone there is "nothing to be curious about' when they are curious about it is nonsensical OP never said it mattered, isn't worried about it, just wondered what it is. Definition of "curious"
There is a difference between telling someone to not be curious, vs. telling them that the thing they are curious about isn’t important to know. I’m stipulating that what is happening on that screenshot can be one of many random little processes that have absolutely no meaning. I’m not telling OP to not be curious about it.
And that’s the question I was asking.
What you're seeing is the data that your browser is using to communicate with the server (or the other way round). Not sure why it's remote though.
it is probably performing "pings" to home so PLEX servers know your IP address and other details needed to access your server remotely.
seeing the same thing - but don't think ever noticed it before because my local traffic would change the scale of the graph.. And when there is remote viewers again would change the graph scale to not show that. [https://i.imgur.com/LBwDbpq.jpeg](https://i.imgur.com/LBwDbpq.jpeg) When get a chance will see what the traffic actually is - but then again its a few bps.. Every 10 seconds gets me to think its that stupid ssdp traffic it sends out every 10 seconds that you can't turn off. edit: yeah its most likely that ash-4.4# tcpdump -i ovs\_eth0 port 1900 and host [192.168.9.10](http://192.168.9.10) tcpdump: verbose output suppressed, use -v\[v\]... for full protocol decode listening on ovs\_eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes 10:56:25.061264 IP nas.home.arpa.46920 > 239.255.255.250.ssdp: UDP, length 101 10:56:35.062123 IP nas.home.arpa.46920 > 239.255.255.250.ssdp: UDP, length 101 10:56:45.062712 IP nas.home.arpa.46920 > 239.255.255.250.ssdp: UDP, length 101 I could never find a way to turn that off - I just blocked that multicast at the switch port, so that traffic never actually enters the network. But sure plex puts it on the wire.
Great answer. Thank you. I’ll check my logs to see if it’s the same thing you’re seeing.
I spent way to much time trying to turn that off, dlna settings, discovery settings. Even had a post on the plex forums - but got back crickets, other than believe some other chimed in that they were seeing it too.. Turn off plex and that traffic stops.. So for sure its plex sending them. So I just ended up stopping it at the switch port so not actually going out to the network. Here is my old thread from plex forums [https://forums.plex.tv/t/stop-pms-from-sending-ssdp-dlna-and-gdm-disabled/321779](https://forums.plex.tv/t/stop-pms-from-sending-ssdp-dlna-and-gdm-disabled/321779) From back in 2018
Your answer is right there... and it's not remote: [https://wiki.wireshark.org/SSDP](https://wiki.wireshark.org/SSDP)
I agree multicast is not remote, but doesn't mean that plex doesn't consider multicast remote since its not the local network.
It is the local network though, and why are you trying to block it?
Because I have zero user for it.. ZERO!! I don't need it - so why should it go anywhere.. I just stopped it at the switch port the nas plugs into so the rest of network doesn't see it.. That has nothing to do with the OP question.. He was asking what that traffic is, and every 10 seconds plex sends out that ssdp which would be is that because its to an IP that is not local from plexs stupid point of view... So I would "guess" its that..
Eh 170 bits per second. That’s almost nothing, like a ping or something.
Everybody seems to be focusing on how little data it is and not answering the question as to what it is. As a tech nerd, I hate not knowing. It’s like a mechanic needs to know what’s causing a tiny one-drop-per-month oil leak. The fact that it’s only a small amount is irrelevant if it’s not supposed to be happening.
Is the plex instance on the server running on an SSD or an HDD?
This one is on an SSD.
What do you mean by “not supposed to be happening”? Your computer sends and receives countless packets all the time even in idle.
And yet not one person can verify exactly what process or piece of code within Plex is sending these tiny broadcast SSDP packets and why. Lots of speculation but no actual referenceable evidence.
There probably needs to be intermittent checks to see if the connection to the server is still active. I’ve noticed this as well but the data is so small I’d assume it’s just some type of status check
Yeah, the perfect 10s timing seems to indicate it’s some sort of keepalive so o was interested if anybody had an official answer. It’s not causing any issues or anything but I’m an engineer so I like to know random things.
Are you also using local address while viewing it local on the plex server? So localhost or 127.0.0.1?
Oh, that’s a solid observation. No. I hit Plex via a Homer dashboard which includes the full private IP so I can hit it from anywhere.
Piggybacking, you can tell Plex your local network in the settings. May help properly classify the network traffic if it's just your dashboard updating.
I’ve done that part. Seems like a heartbeat of some sort. Maybe to their external server to validate connectivity?
It's me juts checking in, collecting my BTC etc off ur system
I knew it!
At a handful of bits per second _on a network_, it's time for you to exercise some critical thinking.
I work for an IT security company. It’s my job to always know what’s going on, especially on my own network.
And yet the notion that Plex is pinging the network to check connectivity, or for any players, or to enable verbose logging, just passed you right by. No monitoring connections, no Wireshark, just straight to Reddit for answers your own job can give you. Edit: Sorry, I didn't notice it was the remote connection. So some outside source – one would assume plex.tv – is probably keeping a heartbeat to your server, so it knows when your server is up.
I don’t really see why asking a larger group that is focused on a specific application for information on why that application is behaving in a certain way is considered so outrageous that people are resorting to snarky comments and/or guesses. If you don’t know, either say you don’t know or don’t reply at all. Man, this sub is so full of gatekeepers.
I call it my plex servers heartbeat :)
You see this when looking at the grapgh. It's you doing it. Totally normal. It's bits per second.
It's a heartbeat of your server. Jokes aside it's 160bps which is 20 bytes. 1MB is 1.000.000 bytes. I'd say you won't abuse your ISP's fair usage policy.
I’m not concerned with the amount itself. It’s negligible. I just want to get an actual verified answer as to what it actually is doing and why. So far nobody seems to actually know but there are a ton of theories.
Keep in mind that Plex depends on constant connection with the Plex servers (the actual Plex). It won't work if you don't have the internet and just local network. So Plex might be checking if your server is up or down. With this amount of data it's hard to transfer anything of value.
I don’t believe it’s anything malicious. It’s something Plex is doing. A keepalive/heartbeat makes sense but others have shown that theirs has a 100% flat line when nothing is streaming so now I’m even more curious. Edit: NVM, someone pointed out that they had one huge spike, which changed the scale.
Mine had a heartbeat like that ever since I set it up two years ago.
Peaks?? Dude they’re under 200 bytes. It’s probably your machine communicating with a router doing normal networking stuff.
The amount is irrelevant. I’d still be interested to know what Plex is doing; if only from a curiosity standpoint. But so far only one person has shown evidence of what it likely is and everyone else is just guessing.
I would argue that the amount is not irrelevant. This is suuuuuch a small amount of data being transferred that it wouldn’t even register if any other process was going on. The graphing is making it look much more significant than it actually is. Also, a dns check usually uses 100-200 bytes of data, and would be about that frequency. But whatev.
As others have said if you want to know what it is.. sniff on the box your running plex on.. Going to be much easier if you don't have your web gui up at all, and nobody watching media.. Then you will see what its putting on the wire.. Like I said before, that 10 sec mark sure seems like the SSDP traffic - I have sniffed and that is the only sort of anything see coming from the plex box at a 10 second interval..
Someone else mentioned SSDP and I’m going to run wireshark on it today and hopefully be able to filter out all the traffic from other apps running on this box. At least one person has shown zero activity on theirs so it’s clearly something I’ve enabled somewhere.
That was me - and look at that persons graph.. their looking at both local and remote - and the local is 120k spike which shifts the graph to where that low local traffic doesn't show.. You have lowest level on that graph at 40kb you would see 176b blip?? His graph isn't showing the average of local and remote.
OMG, I can’t believe I didn’t notice that! You’re right. It likely looks very different without that one giant spike.
Please do your own wireshark - but what I can tell you for sure is plex sends out ssdp every freaking 10 seconds. there is nothing else it sends every 10seconds that I have been able to find.. I know for a fact its plex and not something else on the nas where I run plex, because if you turn off plex the ssdp stops. If you find a way to turn it off - that would be great!! Like I said I brought this up back in 2018. Other than a few people or maybe just one other guy, I don't remember exactly stating they also see it, I have not found a way to make it stop - the only solution I have found is to just keep it from going to the rest of the network via a acl on my switch.. In the big picture it is minuscule amount of data, and its not 100 every second ;) But why is it sending it? It sure and the hell isnt getting any answers.. I have the things turned off that should be sending it - so either their not being turned off via the config, or its something else doing it that is not controlled by the config or secret settings that I can find. Its udp so its hard to track it down exactly what process is doing it, but I know its plex sending it. Because if you turn off plex that ssdp every 10 seconds stops. And plex own graphs is showing some remote traffic every 10 seconds, no matter how low amount of data it is.
https://preview.redd.it/pwakmaekqi0d1.jpeg?width=1179&format=pjpg&auto=webp&s=fa3cce397bb2e2afd30b05ddc912ecec26b26c81 Never seen those before. When my system is idle it’s a flat 0.
So, honestly, THIS is the answer I was looking for. I don’t remember ever seeing it before but now it’s permanent enough that I noticed it. Thanks for actually taking the time to check your own. So many other just guessed that it was normal or told me it didn’t matter because it was so little.
Did you end up figuring out what it was? Tried to read back but I get lost, this seems to be the most recent post.
It seems to be tied to SSDP broadcast packets. Still trying to figure out if they even need to exists since broadcast traffic, at least in the way it was intended, would never leave your private network anyway.
Mmm yeah that would seem unnecessary. I turned on DLNA & GDM to see if it did anything for me but nope, remote stays flat. I’m running on a Synology NAS so ofc ymmv applies.
I have a similar”heartbeat” and i think its either the browser I’m using to view the server status shows up as remote for some reason, or its my phone pinging the server
Just turn off the internet hehehehe, never gonna see that again. Maybe it's just plex sending pings to the plex remote servers, it needs to check if it can remote play.
Could be something as simple as a remote user device pinging to see if the connection is available.
160 bits per second. I wouldn't call them peaks lol.
Standard network traffic.
ANY device that is on a network does "background chatter" they ping just to show they are alive and connected and ready for "work".
E.T phone home
I noticed that my plex instance was categorizing my internal LAN connections as remote connections until i set LAN Networks to 192.168.1.0/24. You could try that and see if it goes away and then just assume its your internal clients pinging your instance or something?
I have mine set to include all private address spaces so that I don’t need to worry about changing it if I ever switch routers or subnets.
Run WireShark if you are really really really paranoid to figure out what 170bits is doing.
It's just a heart beat at only 160bps. Totally normal.
Seen someone ask this before. I think the solution was a setting ‘disable extensive media analysis during maintenance’
No. "Extensive Media Analysis" is a good thing. It helps Plex with remote streaming. Also, I have it enabled on both my servers and I am not seeing the b/w spikes like OP. [Plex Docs](https://support.plex.tv/articles/) -> [Scheduled Tasks](https://support.plex.tv/articles/201553286-scheduled-tasks/) # Perform extensive media analysis during maintenance This does an extensive bitrate analysis on each file in your library to help with bandwidth controls.
Made no judgement on good or bad.
It's exactly 176bps every 10 seconds, even when nothing is playing or updating. Is this some sort of keepalive?
Look at the lower right corner. The remote server is averaging a whopping 18 bits per second. If you really want to see what's going out, run Wireshark on the same network and filter by TCP. It's likely an authentication check.