I have an IP address that Im not familar with connecting to MQTT. How do I find where its coming from?

Configuration
1

I have a 172 address connecting to my mosquito broker. I have no idea what it is though. My router is using 192 addresses for all of my network devices. I can ping this 172 address but I have no idea what it is. Using the fing app I don’t see that 172 address on my network. Could there be something in a mosquito config file somewhere that is doing this? Super confused

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] mosquitto.sh: executing... 
[18:02:34] INFO: SSL is not enabled
[cont-init.d] mosquitto.sh: exited 0.
[cont-init.d] nginx.sh: executing... 
[cont-init.d] nginx.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[18:02:35] INFO: Starting NGINX for authentication handling...
[18:02:36] INFO: Starting mosquitto MQTT broker...
1638324156: mosquitto version 1.6.12 starting
1638324156: |-- *** auth-plug: startup
[18:02:37] INFO: Successfully send discovery information to Home Assistant.
[18:02:37] INFO: Successfully send service information to the Supervisor.
1638324156: Config loaded from /etc/mosquitto/mosquitto.conf.
1638324156: Loading plugin: /usr/share/mosquitto/auth-plug.so
1638324156:  ├── Username/password checking enabled.
1638324156:  ├── TLS-PSK checking enabled.
1638324156:  └── Extended authentication not enabled.
1638324156: Opening ipv4 listen socket on port 1883.
1638324156: Opening ipv6 listen socket on port 1883.
1638324156: Opening websockets listen socket on port 1884.
1638324156: Warning: Mosquitto should not be run as root/administrator.
1638324156: mosquitto version 1.6.12 running
1638324156: New connection from 127.0.0.1 on port 1883.
1638324156: Socket error on client <unknown>, disconnecting.
1638324206: New connection from 172.30.32.2 on port 1883.
1638324206: Socket error on client <unknown>, disconnecting.
1638324215: New connection from 172.30.32.1 on port 1883.
401: Unauthorized1638324215: Socket error on client <unknown>, disconnecting.
1638324239: New connection from 172.30.32.1 on port 1883.
{"result": "ok", "data": {}}1638324240: New client connected from 172.30.32.1 as mqttjs_e431c72d (p2, c1, k60, u'mqtt-user').
1638324326: New connection from 172.30.32.2 on port 1883.
1638324326: Socket error on client <unknown>, disconnecting.
1638324335: New connection from 172.30.32.1 on port 1883.
1638324335: Socket error on client <unknown>, disconnecting.
1638324446: New connection from 172.30.32.2 on port 1883.
1638324446: Socket error on client <unknown>, disconnecting.
1638324455: New connection from 172.30.32.1 on port 1883.
1638324455: Socket error on client <unknown>, disconnecting.
1638324566: New connection from 172.30.32.2 on port 1883.
1638324566: Socket error on client <unknown>, disconnecting.
1638324575: New connection from 172.30.32.1 on port 1883.
401: Unauthorized1638324575: Socket error on client <unknown>, disconnecting.
1638324686: New connection from 172.30.32.2 on port 1883.
1638324686: Socket error on client <unknown>, disconnecting.
1638324695: New connection from 172.30.32.1 on port 1883.
2

172…. Is likely to be something within a Docker container (or an add on). It’s not an Internet routable address so it’s coming from within your own network.

3

All the 172.30.32.X addresses are assigned to the add-ons you have installed. (And also core itself)

1 Like
4

Here is my MQTT error which is occurring repeatedly:

image
image700×118 3.9 KB

It is the gateway address in all my containers for my hassio network:
hassio_supervisor container:

image
image857×216 11.5 KB

hassio_dns:

image
image843×175 9.59 KB

etc., etc.

I am trying to figure out why the error is occurring and how to rectify it…

5

I am seeing the same errors. I think that it just started after the latest Supervisor release 2022.05.0 but not sure.

6

Has anyone figured out how to troubleshoot these errors? it’s spamming my Mosquitto logs and while the IP is always the same the port keeps changing. I don’t even see this IP when looking at my Portainer add-on which is odd.

image
image761×416 11.6 KB

7

I have this spam from 172.30.32.2 as well in 2025… It is slowing down my system quite a bit i think.

Anyone has a solution years later?

8

Same here! Am I to assume that no one has figured this out?

9

That is the Supervisor, likely checking if the add-on is still responding as part of a health check.

2 Likes
10

Ah, that makes sense. Is there any way to tune it to make it less noisy? I know nothing about the requirements of the Supervisor, but I could imagine a world where it could wait longer than 2 seconds between checks without too much harm. I could be wrong. :slight_smile:

11

Same here

New connection from 172.30.32.2:54674 on port 1883

Every time

2025-10-09 14:30:55: New connection from 172.30.32.2:39534 on port 1883.
2025-10-09 14:30:55: Client closed its connection.
2025-10-09 14:32:55: New connection from 172.30.32.2:47934 on port 1883.
2025-10-09 14:32:55: Client closed its connection.
2025-10-09 14:34:55: New connection from 172.30.32.2:46620 on port 1883.
2025-10-09 14:34:55: Client closed its connection.
2025-10-09 14:36:55: New connection from 172.30.32.2:51048 on port 1883.
2025-10-09 14:36:55: Client closed its connection.
2025-10-09 14:38:55: New connection from 172.30.32.2:54150 on port 1883.
2025-10-09 14:38:55: Client closed its connection.
2025-10-09 14:40:55: New connection from 172.30.32.2:35268 on port 1883.
2025-10-09 14:40:55: Client closed its connection.

Is there any way to set a delay bettween checks?

12

*2 minutes :wink:

13

Oh, right. Haha. Ok yeah, 2 minutes doesn’t seem unreasonable at all. See, I told you I could be wrong. :wink:

1 Like