Well..I think I fingered it out. I figured out I needed to sniff the packets from the start of the transmission so I could pick up the server certs. They belong to Sentry AI. I have that subscription and it is enabled. Funny thing is, its enabled on all of the cameras...not just the 2. I didnt reali...

Uhhh, close the freaking port? And by what/whose SSL certificate are these connections being made? I have blocked those IP address at the fw...keep in mind its primarily outgoing and on port 443. So I cant exactly block that port. I dont know how to figure that out whose cert they are encrypting on...

I went through and disabled all the cameras and brought them online individually and watched TCPview for external connections. It is related to the last 2 cameras that I installed. They are generic/ONVIF dome ptz cameras I got from Amazon https://www.amazon.com/gp/product/B0BXS1XMXD/ref=ppx_yo_dt_b_...

It is the BlueIris.exe that is opening TCP/443 connections at the IP addresses I listed...I have actually added 1 or 2 more since I posted that less than an hour ago. Its definitely not another app or process on the machine.

According to BI support, BI shouldnt be sending anything at all to AWS....especially not that much data. Below is a list of IP addresses Ive collected and blocked so far. It seems that when BlueIris.exe starts up it reaches out to one of the 216.239.x.x ips first then tries to establish connections ...

Thanks for responding. But this is too much data going out just for polling. As far as I know, the bi android app connects directly since port forwarding had to be set up to work. Polling wouldn't even be necessary I don't believe.

No...i use the BI android app. Thats the only app that is connects to the BI server. And BI is the only thing running on it.

Picked up on my firewall a lot of traffic from my BI5 server to different Amazon AWS instances. In one day it was 10G. I put tcpview on the machine and traced it to BlueIris.exe. I watched it for about 30 minutes and it sent up almost 3G in that time to this server on AWS: ec2-44-229-182-9.us-west-2...