ZimaOS 1.2.3 bittorrent DHT ping requests

ZimaOS
1

I upgraded to ZimaOS 1.2.3 and now my IDS is seeing and blocking outgoing bittorrent DHT ping requests to various sites in Russia, US, Japan, and other countries. Obviously, some countries are more of a concern than others. Does anyone know what this is?

Date/Time
Sep 05, 2024 at 3:16:09 PM 
Device:  imaCube
Counterpart. 95.26.70.110
Counterpart Location: Yekaterinburg, Russia
Direction: Outgoing
Detection Category: P2P
Signature: ET P2P BitTorrent DHT ping request
Traffic Information
Source IP:  192.168.1.68:51413
Destination IP:  95.26.70.110:2044
2

Are you using software like qBittorent?

3

I’m running ZimaOS right out of the box. I didn’t install any apps. So it appears that something inside of ZimaOS is running a bittorrent server. Not thrilled about this at all.

4

According to at least 1 forum, a PIA (private internet access) vpn can cause something like this. So it’s likely that zerotier is the culprit and the request is mislabeled/mis-categorized.

5

But I’m not using a PIA or VPN for internet access. This definitely started when I upgraded ZimaOS to 1.2.3. It’s unlikely there is any other cause. I don’t think any operating system (looking at you Windows) should send telemetry without permission, and definitely shouldn’t send it to multiple sources in various countries. Even it it’s just mapping links to bittorrent servers, it should be documented and there should be an option to disable it.