Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[RYAT3]

So this is only when you log into the admin pages for the router?

I could see it checking on the date/time, but that's kind of crazy.

[FurryNutz]

If you seem to exhibit or continue to see problems, please factory reset and setup from scratch to confirm if problems continue or not.

Thank you.

Was curious if you had any updates on this?
Have you tried v1.21 FW version?

I've recently install Firmware 1.21B03 BETA. No change, it's still phoning home. I've purchased some hardware that will allow me to do some packet sniffing, but haven't had the opportunity to do so. When I get around to it, I let you know what I find.

Larry ....

[LarryNOTtheCableGuy]

So this is only when you log into the admin pages for the router?

I could see it checking on the date/time, but that's kind of crazy.

The router checks the date/time on a regular basis, at a reasonable interval, whether you're logged into its admin pages or not. My impression (haven't done any exhaustive testing) is that it starts to phone home at an alarming rate (100s of time per minute) only when you access the Connected Clients page. Again, I haven't gone looking for any other triggers at this point.

If it's simply trying to look up the manufacturer for each connected device (i.e., matching mac addresses to manufactures), that's not a big problem. However, it's doing this via the US, Taiwan and China motherships, and unsuccessfully in many cases. If it's doing something more nefarious, that's a problem.

Larry ....

[FurryNutz]

I'll have D-Link look into this again...

[GreenBay42]

OK I am assuming you have the default gateway on your clients pointing to the pi-hole. Is DHCP enabled on the pi-hole (and disabled on the router)?

If you are showing a large amount of traffic from source IP of the router, this is normal. This is not the router making all these requests. You are basically creating a double-NAT without the NAT with the pi-hole so what you are seeing is your client making a request going to the pi-hole for DNS resolution, then going through the router to the internet. When the traffic comes back to the client, it is hitting the router, the router then has to send it back to pi-hole and then to the client.

I wouldn't worry too much about this. If you put a sniffer on the WAN side and remove the pi-hole but still see this traffic, then there may be an issue.

[LarryNOTtheCableGuy]

OK I am assuming you have the default gateway on your clients pointing to the pi-hole. Is DHCP enabled on the pi-hole (and disabled on the router)?

If you are showing a large amount of traffic from source IP of the router, this is normal. This is not the router making all these requests. You are basically creating a double-NAT without the NAT with the pi-hole so what you are seeing is your client making a request going to the pi-hole for DNS resolution, then going through the router to the internet. When the traffic comes back to the client, it is hitting the router, the router then has to send it back to pi-hole and then to the client.

I wouldn't worry too much about this. If you put a sniffer on the WAN side and remove the pi-hole but still see this traffic, then there may be an issue.

My router is configured so that it's pointing to my ISP as the default gateway and DHCP is enabled. I'm not using pi-hole for DHCP. However, I do have it setup with unbound as a recursive, authenticating DNS server. My network is setup with a double-NAT; one in the DSL modem, and one in the router. Finally, all of the devices on my network are assigned static IP addresses, and the hosts file on the RPi running pi-hole has been populated so that pi-hole displays human readable names for each device (as opposed to just IP addresses).

pi-hole displays the DNS requests for each device on the network. I can see what each device, including the router, is requesting. When I access the router's Connected Clients admin page, the router starts generating 100s of request per minute for the following URLs: www.dlink.com, dlink.com, www.dlink.com.tw, dlink.com.tw, www.dlink.com.cn, and dlink.com.cn. I've just confirmed that no other admin page displays this behaviour. I've blacklisted the latter 4 URLs.

[GreenBay42]

oh strange. OK. I am assuming that some of that mydlink traffic is connecting to databases to resolve client's vendor information/name. So when you leave the connected clients page it stops?

[LarryNOTtheCableGuy]

oh strange. OK. I am assuming that some of that mydlink traffic is connecting to databases to resolve client's vendor information/name. So when you leave the connected clients page it stops?

I'm going to have to walk back a bit of what I just said. This behaviours occurs with more than just the Connected Clients page. While I was typing my last message I accessed all of the router's admin pages except for the Connected Clients page. pi-hole is reporting that the router generated 420 DNS requests in a 10-minute period; most of the requests being for the URLs listed above.

I agree that some of the requests might be for vendor information, but I'm thinking it's likely more than that. Regardless of what it's doing, it appears to be doing it in a very inefficient manner.

Larry ....

[GreenBay42]

If you un-blacklist the blocked URLs does it still request at a high rate?  Since you blocked it, the router is probably re-trying to connect to mydlink and not hearing back.

[LarryNOTtheCableGuy]

If you un-blacklist the blocked URLs does it still request at a high rate?  Since you blocked it, the router is probably re-trying to connect to mydlink and not hearing back.

I haven't tested this, but I don't think blacklisting the URLs has any effect on the rate. Of the six URLs I've listed above, only four are blacklisted. The DNS request rate for all six is identical, even when some are blacklisted.

Just one more data point. Included in this spike in router activity are DNS requests for www.google.com, google.com, www.mydlink.com and mydlink.com. Each of the 10 URLs appear to be requested at the same rate.

Larry ....

[FurryNutz]

FYI, Security update for the DIR-885L:
http://forums.dlink.com/index.php?topic=75404.0

[dg_102]

I can confirm that the router send requests to:

2020-07-16 12:50:31    AAAA   www.dlink.com.cn
2020-07-16 12:50:31    A   dlink.com.tw

I am also using pi-hole on a local server as my DNS.
I just blocked those in Pi-Hole with the blacklist regular expression.

dg