Why is ESET VPN constantly contacting a server in Albania, even when I am not using it.

[BillBui 0]

 

I recently upgraded to Home Ultimate the includes the ESET VPN service.
I installed the vpn client. 

Soon a network security monitor altered me to the fact that there as unusual frequent traffic to Albania.
When ESET VPN application is running, but not connected, it sends a constant stream of network connections to:

194.113.94.
210 87.120.103.226

Seeming to partially target port 6363.

It does this constantly and many times in a minute. 

After some checking around I guess at least one of the addresses is connected 
to Windscribe VPN.

Some more searching on the web isolated that ESET vpn is just a branded version of Windscribe.

From all of that I guess the connection is  benign and phoning home.

However I see no reason in the world that it should require to do so constantly
many times a minute for hours and hours ep. when the VPN is -not. in use.

Can I turn off this behaviour? 


 

 

[itman 1,924]

Since you posted the same question on reddit.com, a reply given there is a good explanation;

Quote

The IP is owned by "Windscribe Limited" which after a cursory Google search shows they are a VPN provider. I presume this is one of their products with ESET branding. Either that or do you have any Windscribe VPN installed? I assume it's just "phoning home" as a lot of software does these days.

https://www.reddit.com/r/eset/comments/1gery8b/why_does_eset_vpn_constantly_hits_two_ips_in/

[BillBui 0]

The question is "Can I turn off this behaviour? "

It has not yet been answered on Reddit, so I posted it here. 
Hopefully someone can do more than point out that 

"I assume it's just "phoning home" as a lot of software does these days."

[itman 1,924]

Check and see if this option exists in Eset's implementation of Windscribe VPN: https://windscribe.com/knowledge-base/articles/how-to-use-the-windscribe-app-network-options/ . If it does, configure it to your liking.

[BillBui 0]

Thank you for helping.

That was a link to a guide on how to configure the Windscribe VPN client to "Auto-Secure Networks".which is not related to the question I have posed. 

I took a look around other guides and I did not find any mention of this issue.

Further trying various searches on Windscribe in general, with the search terms
I could come up with , I do not see anyone mentinng Windscribe constantly "calling home"
several times a minute for several hours. Never ending as far as I can establish. 

I also cant fimd any other post from peple wiht ESET VPN seeing the problem.https://www.eset.com/int/home/vpn/

And as you also pointed out, there are only two posts it appears that is on the topic of
ESET VPN / Windscribe VPN constantly contacting Albania. 

 

That may indicate that this problem deserves a bit more attetion.
esp. since this originates in "internet security and malware protection" suite,. 
Since ESET is actively selling and promoting "their" VPN solution. 
I do think in so far as problems with the VPN goes, that falls on them, not on Windscribe. 

By postin here I do ask the question that I still hope can be answered.
and I hope that other users who may have seen something similar can speak up.

Are you using ESET VPN? 
If so are you seeing consntat conncetions out from it?

Perhaps not for Albania?

When the VPN is -not- ON. 

 

 

[itman 1,924]

Since no one else has answered your inquiry on this issue, I suggest you submit an Eset tech support request via in-product option to do so;

Edited October 30, 2024 by itman

[Swamp Yankee 8]

I don't use it, but reading about ESETs VPN just now, and VPNs in general:

ESETs VPNs default connection mode is 'Auto-Connect', When enabled, the ESET VPN app connects to the last used location.

You could try turning 'Auto-connect' off and going manual.

"The default option is Automatic, although you can select the connection mode manually. Set it to Manual, and select the Protocol and Port from the drop-down menu. There are six protocols available regardless of your operating system"

General VPN stuff-

"Some VPNs have an auto-connect feature that automatically establishes a connection whenever you join a new network, even if you are not actively using the internet."

also VPN's use "Keepalive packets"

"A VPN might constantly contact a server even when not actively in use because of a feature called "keepalive packets," which are small data packets sent periodically to maintain the VPN connection and ensure it doesn't drop unexpectedly, even when no active data is being transferred; this is a standard practice to maintain a stable connection and prevent potential security vulnerabilities.

You should also Google Auto-connect vs manual connect

I guess Auto-connect is more secure than manually connecting, do to that time gap of manually connecting vs being always connected

Windscribe does have a server in Albania

 

Don't know if its correct, but Google's Generative AI says

"To turn off auto connect for ESET VPN, you can manually select the connection mode

1. Go to Advanced setup

2. Under Network options, click Current network

3. Select Manual connection mode

4. Choose the Protocol and Port from the drop-down menu

 

 

 

 

 

Edited October 31, 2024 by Swamp Yankee

[BillBui 0]

As I stated this all happens when the VPN is -not- running / active.
Nor is it set to start on its own.
 

[BillBui 0]

@itman   yes I think you are right and I will do so. 
Perhaps if I learn anything I can update the post with it

[itman 1,924]

12 hours ago, Swamp Yankee said:

also VPN's use "Keepalive packets"

"A VPN might constantly contact a server even when not actively in use because of a feature called "keepalive packets," which are small data packets sent periodically to maintain the VPN connection and ensure it doesn't drop unexpectedly, even when no active data is being transferred; this is a standard practice to maintain a stable connection and prevent potential security vulnerabilities.

I believe this is the best answer for the constant network activity. It will also occur whether the VPN is currently active or not to facilitate rapid VPN connection when activated.

As far as IP address, 87.120.103.226, it is actually an ISP provider in Bulgaria. Assumed here is WindScribe just shopped around for cheapest server use for their connectivity verification processing.

[Peter Randziak 1,223]

Hello guys,

this network traffic is caused by the 'ping' mechanism in the application, which is used to determine latency between the app and each location.  In this case, ping requests to the Albania location are failing. 
The application will retry failed pings every minute. As of now, it is not possible to disable it.
However, you can go into the "Advanced parameters" setting, add the 'ws-use-icmp-pings' parameter (without the quotes), and restart the application. 
This will switch the ping mechanism to use ICMP pings, which may not trigger the network security monitor. 
The default ping mechanism uses https requests to port 6363.

Please note this advanced parameter is only available in the Windows application.