What's new
  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

PIA Client Traffic when no vpn connected

agilani

Very Senior Member
Is anyone else using private internet access (PIA) and using their client. I was doing some wireshark captures and was seeing a ton of traffic from random udp source ports to random ip addresses to udp destination port 8888. After tracking this down, it appears to be PIA client traffic to PIA servers....even though the VPN was disconnected. It was not easy to track down. Given that the source ports were random and short lived and netstat did not show anything. I was able to track down the ASN of one of the destination IP's and it was registered to PIA parent company. Many of the other IPs were not.
 
PIA speedtest, just search for “pia port 8888” will give you a lot of results on Google.

Edit: They say it’s for picking the fastest server for you when you set the Server to Auto but I still see 8888 traffic if Server is set to a specific location. I generally exit their application if I’m not using the VPN.

sauce
 
Last edited:
PIA speedtest, just search for “pia port 8888” will give you a lot of results on Google.

Edit: They say it’s for picking the fastest server for you when you set the Server to Auto but I still see 8888 traffic if Server is set to a specific location. I generally exit their application if I’m not using the VPN.

sauce
Thanks,
When i google'd it most of the links take me to the pia forum which was closed. I guess its becoming fashionable to stop providing a community forum. I will be exiting the application and disabling auto startup as well. I was intrigued why they used so many different source udp ports. Almost makes it look like malware trying to disguise itself.
 
I was intrigued why they used so many different source udp ports. Almost makes it look like malware trying to disguise itself.

Client software usually don’t specify their ports, it’s not trying to disguise anything. This is normal.

If it’s malware trying to disguise itself it’ll try to be stealthy and not creating rapid connections like that, that’s very noisy.
 

Similar threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Back
Top