I got a new TP-Link router a couple months ago, and configured it to use the OpenDNS domain servers for basic content filtering across all household WiFi devices. Everything seemed to be great.

Tonight I pulled up the OpenDNS dashboard to make some minor adjustments, and skimmed the various stats out of curiosity. I was shocked to see a huge number of requests to tp-link.com, the manufacturer's website. In fact, the requests account for 40% of all network requests over the last 2 weeks!

Top domains and request count

I am running the latest firmware, and have double checked that I configured the DNS properly to use the OpenDNS IPs:

Screenshot of router DNS settings

  1. Is there any legitimate or overlooked reason for this traffic, or is my router just phoning everything home to China? There are no telemetry settings anywhere in the router management tools.

  2. What are my options? I've blacklisted the site on OpenDNS now... should I also flash OpenWRT or something?

  • 1
    Note from the future - never did find a way to disable this in settings. It sounds a lot like this NTP issue reported in 2017, which was supposedly fixed in firmware, but mine is still happily pinging away every 15 seconds.
    – brichins
    Sep 24, 2019 at 0:01
  • 2nd note from the future - after switching DNS and entirely blocking the mfg domain, the router never reported outages or showed any other behavior changes.
    – brichins
    Jul 14, 2021 at 15:41

1 Answer 1


It most likely checks for updates.

I've noticed such behavior in many recent routers: they periodically check their home site for new firmware. If there is a new version available, it will notify you that an update can be done in the update menu.

On the one I have I was able to make the update directly via the router menu, without needing to download the new firmware locally.

In such a case, you should also have somewhere the option not to check for updates. Disabling update check may reduce that traffic or even make it permanently go away.

Of course, there may be the possibility of a compromised device, but in that case it will not try to connect to its official site, but to various C&Cs.

One additional thing that may be working there is a status check of Internet connectivity the router does. Some can indeed do that just by ICMP requests to their own home sites. If they see that's not working, the router could then report that your Internet connection is down if it does not make any other checks except that one (but the well designed ones should not relay on a single check-point for determining connectivity status).

  • 2
    That might be true, but in this case it's totally poorly designed if it makes a new DNS query every 15 seconds. May 8, 2019 at 10:04
  • Indeed. Some routers I've encountered have options like weekly or monthly update check, some let you specify the number of days/hours between checks. Some can use a keep-alive status check too. I'll complete this also in the answer.
    – Overmind
    May 8, 2019 at 12:37
  • One thing that you can do to analyze the situation better is to put Wireshark between your router and your WAN connection to see what the content of the request is.
    – user163495
    May 8, 2019 at 12:43
  • 1
    True, but port mirroring a home router WAN is not too easy to accomplish. Some routers support port mirroring; but the problem is for the ones that don't.
    – Overmind
    May 8, 2019 at 12:57
  • I have a hard time believing it's performing a simple update check 4x /minute, as Esa notes. I'll check again for update options and monitor what happens the next couple days, but I'm hoping for something more specific so I'll give it a couple days before accepting an answer.
    – brichins
    May 8, 2019 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .