Serviio

I have Win 7 64 running a Serviio DLNA Server (v1.1). The router I am using is a Technicolor TG582n.

I have set up the Router to use "WPA-PSK Encryption" and only "allow New Stations via registration". As such all the "detected devices" listed on the Router are owned by my family and are ones I've actively registered.

The reason for this post is that last night I had a warning (via Norton 360) of high CPU usage from ffmpeg.exe. I believe that ffmpeg.exe is used by Serviio (for transcoding?). The usage peaked at 95% and when monitored via task manager typically was using 25%. At this point, I was the only person on the computer and only using it for browsing.

When I checked Serviio console, I noticed that there were two devices with IP addresses that did not match any of the devices allowed on the Router.

My immediate concern was whether someone was accessing my DLNA server without my knowledge.

So I have few questions:

1) Why can Serviio "see" devices that are not allowed by the router and is there different security settings for DLNA access?

2) What other programs could have been using ffmpeg.exe?

3) Is there anyway of monitoring DLNA activity?

1) Serviio sees any device on your network. If it's listed, then for whatever reason that device was on your network. DLNA has in and of itself no security. It's designed for use on private networks, and cannot be accessed beyond the local IP address range. So it might be seeing your smart phone, a WiFi tablet, even a smart watch.

2) There are other programs that might use FFMPEG, but they're all going to be related to media use. You would likely know if you had some other software installed that uses FFMPEG. For example, Handbrake uses it, as does many other media manipulation programs.

That said, Serviio also uses FFMPEG when examining media for metadata extraction. I wouldn't expect CPU use to be that high unless it's performing transcoding, in which case CPU use is usually close to 100%.

3) I'm sure there are such monitoring programs, but I've never looked for them so have no suggestions. Wireshark of course can scan your network for almost anything, but it's a very complicated program to use.

If you are truly running Serviio 1.1, you are really, really using an old version. That was released December 19, 2012. There are huge improvements in Serviio since then.

A few things are worth checking before assuming someone got into your network. DLNA itself is not really a security-focused protocol — it relies on being inside the same local network. Your router's Wi-Fi restrictions control who can join the network, but they don't necessarily control what devices Serviio discovers through UPnP/DLNA broadcasts.

Those extra IP addresses could be things like a device that was previously connected, a virtual adapter, another network interface, or even a device that changed IP addresses through DHCP. Serviio discovering a device doesn't automatically mean that device has accessed your media library.

The ffmpeg CPU usage is also not necessarily suspicious. Serviio launches ffmpeg for transcoding when a client needs a format converted on the fly. A single video being played by a TV, phone, or media player can easily cause high CPU usage. Other software can use ffmpeg too, but if the process is running from the Serviio installation folder it's most likely Serviio.

For monitoring, you can check Serviio's logs (enable more detailed logging in the console), and also check your router's connected devices/DHCP list. Tools like Wireshark can show DLNA/UPnP traffic if you really want to dig into network activity.

Also keep in mind that old versions like Serviio 1.1 and Windows 7 are quite dated now, so if this machine is still online it's worth considering updating Serviio and the OS if possible. The symptoms you describe sound more like normal DLNA discovery/transcoding behavior than an intrusion, though.