Axe-Edit checks in with server while I use it

[Twister]

I've noticed that Axe-Edit checks in with the server regularly while I'm using it. I'm a privacy nut and I would be interested in what the purpose of this communication is.

 

[Rex]

Axe-Edit checks for new versions of itself at startup (you can turn that feature off). To my knowledge, that’s the only time it phones home. Are you seeing traffic at other times?

 

[Twister]

My network monitor indicates that during most sessions Axe-Edit is checking in with fractal audio.com every 20 seconds on port 80 (quic protocol). This is different than the two check-ins which occur at startup (one on port 80, one on port 443, both http protocol), which occur when the check for updates feature is enabled.

This constant check-in behavior occurs during >80% of sessions but doesn't happen every time.

 

[unix-guy]

Tagging @Michael Pickens and @Admin M@.

This seems odd.

It's not a licensed software and shouldn't require any sort of "phone home" capability other than checking for new versions of the editor or the firmware at startup.

As @Rex said, that can be disabled in the settings.

Sounds like you have tried disabling those but then you're still seeing some repeated access?

Also, please include the version of Axe-Edit that you're running.

 

[Rex]

My network monitor indicates that during most sessions Axe-Edit is checking in with fractal audio.com every 20 seconds on port 80 (quic protocol). This is different than the two check-ins which occur at startup (one on port 80, one on port 443, both http protocol), which occur when the check for updates feature is enabled.

This constant check-in behavior occurs during >80% of sessions but doesn't happen every time.

Curious. What’s left over when you strip away the headers? Anything interesting?

 

[Greg Ferguson]

Tagging @Michael Pickens and @Admin M@.

This seems odd.

It's not a licensed software and shouldn't require any sort of "phone home" capability other than checking for new versions of the editor or the firmware at startup.

As @Rex said, that can be disabled in the settings.

Sounds like you have tried disabling those but then you're still seeing some repeated access?

Also, please include the version of Axe-Edit that you're running.

Agreed, it seems odd, and unnecessary after the initial connection. I can see that it could be useful being able to manually initiate a ping of the server to check for an update, but it repeatedly phoning home seems… excessive.

 

[hippietim]

My network monitor indicates that during most sessions Axe-Edit is checking in with fractal audio.com every 20 seconds on port 80 (quic protocol). This is different than the two check-ins which occur at startup (one on port 80, one on port 443, both http protocol), which occur when the check for updates feature is enabled.

This constant check-in behavior occurs during >80% of sessions but doesn't happen every time.

What's the contents of the post upgrade check on port 80? Url? Headers? Anything?

 

[Greg Ferguson]

I've been monitoring Edit using tcpdump and Wireshark all morning looking for traffic to Fractal's server on ports 80 and 443, and the only thing I've found is Edit's initial connection to the server to capture the release notes, which redirects to the RSS feed, which I'd expect. After many minutes there wasn't any additional traffic. I also tested with FM9-Edit, with the same behavior and results.

 

[Greg Ferguson]

What's the contents of the post upgrade check on port 80? Url? Headers? Anything?

It appears to be the HTTP headers as the communication is on port 80. I'm rusty on those but my Edit asked for the release notes from the RSS feed, and the server redirected it to the feed. Otherwise there's handshake and shutting down the connection.

sudo tcpdump -i any -nn host 192.190.220.222 -vv

 

[hippietim]

The response to the request could be helpful as well.

 

[Greg Ferguson]

I did see some QUIC traffic, but it wasn't to Fractal's host, it was my DropBox syncing.

 

[Greg Ferguson]

The response to the request could be helpful as well.

It looks like a compressed reply because Edit is allowing */* and gzip, deflate. I did a wget of the RSS URL and the resulting file is a regular ol' Edit Release Note.

 

[Greg Ferguson]

There is some initial traffic to 443, but it's not repeating either.

 

[hippietim]

I did see some QUIC traffic, but it wasn't to Fractal's host, it was my DropBox syncing.

This would make sense if the directory you're using for editor data is in a locally mapped Dropbox folder

 

[fuzzydude]

I decided to have a look using Wireshark (only tested with Win10) and did not see any spurious transmissions from the Axe-Edit software. What I did see was a set of TCP Retransmissions two minutes after starting the app, but when all the ACK were received it went silent.
This is normal. When an acknowledgement (ACK) of a transmitted packet isn't received, some apps use a time-out based retransmission to try to get that missing acknowledgement.
This would probably be more common on slower networks or when more distant from the Fractal server being used.
@Twister How fast is your network speed and where are you located? If you have any packet loss you might see more of those TCP retransmissions for a while. Nothing concerning from a security perspective though.