High network quota usage even for less than 1 min play

[bharathganji1@gmail.com]

HI team, 

my VPS details 
- Linux  5.15.0-1040-oracle #46-Ubuntu SMP aarch64 aarch64 aarch64 GNU/Linux
 
jellyfin details:

Code:

LABELS
build_version Linuxserver.io version:- 10.8.10-1-ls221 Build-date:- 2023-08-08T12:45:05+00:00
com.docker.compose.config-hash 196310d7343b92cff42ddee9e1a07816e2f2ed12571f94c0c4ba6bbe2c64d85d
com.docker.compose.container-number 1
com.docker.compose.depends_on
com.docker.compose.image sha256:c7b700b594b3105f2d5d8b8f0402301290ec3a58e366e77a7e7b54dbbfd664b5
com.docker.compose.oneoff False
com.docker.compose.project jellyfin
com.docker.compose.project.config_files /data/compose/13/docker-compose.yml
com.docker.compose.project.working_dir /data/compose/13
com.docker.compose.service jellyfin
com.docker.compose.version 2.17.2
maintainer thelamer
org.opencontainers.image.authors linuxserver.io
org.opencontainers.image.created 2023-08-08T12:45:05+00:00
org.opencontainers.image.documentation https://docs.linuxserver.io/images/docker-jellyfin
org.opencontainers.image.licenses GPL-3.0-only
org.opencontainers.image.ref.name deaf7c89f577a93072e5bfd007dc7f21f19a78e1
org.opencontainers.image.revision deaf7c89f577a93072e5bfd007dc7f21f19a78e1
org.opencontainers.image.source https://github.com/linuxserver/docker-jellyfin
org.opencontainers.image.title Jellyfin
org.opencontainers.image.url https://github.com/linuxserver/docker-jellyfin/packages
org.opencontainers.image.vendor linuxserver.io
org.opencontainers.image.version 10.8.10-1-ls221

for demonstration i've restarted my jellyfin container before playing any video, below are network stats
https://ibb.co/BrLrp91
https://ibb.co/jDJgYdg


now after playing a video for 1min
https://ibb.co/59bM2Mt
https://ibb.co/1RJdJ0Z


i've disabled all transcoding options
https://ibb.co/W3JWgjc

and details of movie i played

Code:

Audio
Title: AAC - Stereo - Default
Language: und
Codec: AAC
Codec tag: mp4a
Profile: LC
Layout: stereo
Channels: 2 ch
Bitrate: 129 kbps
Sample rate: 48000 Hz
Default: Yes
Forced: No
External: No

Video
Title: 720p H264 SDR
Codec: H264
Codec tag: avc1
AVC: Yes
Profile: High
Level: 41
Resolution: 1280x534
Aspect ratio: 2.40:1
Interlaced: No
Framerate: 23.976025
Bitrate: 1149 kbps
Bit depth: 8 bit
Video range: SDR
Video range type: SDR
Color space: bt709
Color transfer: bt709
Color primaries: bt709
Pixel format: yuv420p
Ref frames: 1
NAL: 4

Subtitle
Title: English - SUBRIP - External
Language: eng
Codec: SUBRIP
Default: No
Forced: No
External: Yes

and for every skip (eg : 10sec forward) again network is consuming 1-2gb of data.

---

logs :
have attached as .txt

[bitmap]

Are the numbers in the second screenshot a snapshot in time? As in the console network monitor? Because I'm not sure how you'd get 2.3+ Mbps out of a 1.3 Mbps (on a good day) file. (EDIT: I was doing quick math and 60s of 1300 kbps video without thinking about any other data would be ~10 MB total. None of the numbers match, which is why I ask this question.)

The numbers don't add up and there's nothing in your logs -- including if it were to do with any additional processes like metadata scraping or plugins or anything. In the second screenshot there are multiple connections to your server, correct? Could this be the culprit? Multiple connections immediately pulling large amounts of data? I guess I might just not be familiar with the tools you've used to provide this info. I understand the aggregate and the console monitor appears to show connections + incoming/outgoing. Multiple connections to your VPS would explain high usage. If you don't expect those connections, you might investigate who's accessing your server and figure out your security situation.

[bharathganji1@gmail.com]

https://ibb.co/BrLrp91
https://ibb.co/59bM2Mt
this are pics from portainer (container management platform)

pls ignore other pics for now.., those pics are taken with cmd iftop (network stats monitor tool) , i dont have idea on numbers you were mentioning

i can confirm no parallel connections to this vps, like only i user/client is using the application. no chance of security issue (even so every other time we should see those connections, but can see only during that 1min play period)

so, if u cant see any suspicious log entries.. then as u said parallel connections might be issue.. but what are these connections, they are getting triggered every time i play a video.., and that to are single user jellyfin connections.

might be the issue, why we have that many connections to single user..

[bitmap]

Portainer I understand, I run it myself. It's the other data you provided that's slightly confusing (to me). The logs don't indicate multiple connections which is the odd thing. I've not seen the message about the default method for recording playback stats being "delete" before either... Is your plugin working okay?

I'm not sure I can offer anything more of substance to you other than to point you towards a) enabling debug logging to see if you can get more verbose output out of Jellyfin and/or b) using something like Wireshark (I think that's the right tool, networking isn't my thing could you tell?) to snoop all the traffic coming and going from that VPS or at very least the container. If you use your containers the way they're supposed to be used, it's disposable so installing Wireshark on there for a bit to monitor and then recreating it after you've identified the issue shouldn't be problematic.

[bharathganji1@gmail.com]

hi @bitmap,

these following findings are intresting..
i've completely deleted server and installed it again, but no use , still issue persist.

i've meg (201 and pizza 3 The mummy - as mkv format
and remaining movies - as mp4 format

when ever i play mkv format looks like transcoding trigging and i can see data usage is optimal (in mb's as per play)
but in case of when i play mp4 then network usage is high again (eg: in gb's)

logs:
https://icedrive.net/s/bPiBR7FiyXYD3uW3xhPutjwwWvgj

simplified chatGPT analysis when i compare 1 mp4 file vs 1 mkv file

Certainly, here's a comparison of the differences between Log 1 and Log 2:

**Log 1:**
- **Date and Time:** Log 1 is timestamped on "[2023-09-01 21:52:32.494 +05:30]" and contains entries that occurred around this time.
- **Content:** Log 1 primarily relates to media playback, transcoding, and monitoring of events during the playback of "The Meg (201."
- **Playback Method:** It mentions "Transcode" as the playback method due to unsupported video and audio codecs.
- **Events:** Log 1 includes events related to starting and stopping playback, slow HTTP responses, and monitoring playback events.

**Log 2:**
- **Date and Time:** Log 2 is timestamped on "[2023-09-01 21:42:30.525 +05:30]" and contains entries that occurred around this time.
- **Content:** Log 2 also relates to media playback but with a different media item, "The Super Mario Bros. Movie." It uses "DirectPlay" as the playback method, meaning there's no transcoding involved.
- **Events:** Log 2 includes events related to starting and stopping playback, slow HTTP responses, and monitoring playback events, similar to Log 1.

**Differences:**
- **Media Content:** Log 1 involves the playback of "The Meg (201" with transcoding, while Log 2 involves "The Super Mario Bros. Movie" with direct playback.
- **Playback Method:** Log 1 uses transcoding ("Transcode") to adapt media for playback, whereas Log 2 uses direct playback ("DirectPlay"), indicating that the media format is natively supported.
- **Item Names:** Log 1 mentions "The Meg" as the item being played, while Log 2 mentions "The Super Mario Bros. Movie."
- **Timestamps:** Log 1 and Log 2 have different timestamps, indicating that these events occurred at different times.

In summary, the key differences between Log 1 and Log 2 are the media content being played, the playback method used, the item names, and the specific timestamps of the events. Both logs relate to media playback and event monitoring within the same application or server but with different media items and playback methods.