5

I got a new TP-Link router a couple months ago, and configured it to use the OpenDNS domain servers for basic content filtering across all household WiFi devices. Everything seemed to be great.

Tonight I pulled up the OpenDNS dashboard to make some minor adjustments, and skimmed the various stats out of curiosity. I was shocked to see a huge number of requests to tp-link.com, the manufacturer's website. In fact, the requests account for 40% of all network requests over the last 2 weeks!

Top domains and request count

I am running the latest firmware, and have double checked that I configured the DNS properly to use the OpenDNS IPs:

Screenshot of router DNS settings

  1. Is there any legitimate or overlooked reason for this traffic, or is my router just phoning everything home to China? There are no telemetry settings anywhere in the router management tools.

  2. What are my options? I've blacklisted the site on OpenDNS now... should I also flash OpenWRT or something?

6

It most likely checks for updates.

I've noticed such behavior in many recent routers: they periodically check their home site for new firmware. If there is a new version available, it will notify you that an update can be done in the update menu.

On the one I have I was able to make the update directly via the router menu, without needing to download the new firmware locally.

In such a case, you should also have somewhere the option not to check for updates. Disabling update check may reduce that traffic or even make it permanently go away.

Of course, there may be the possibility of a compromised device, but in that case it will not try to connect to its official site, but to various C&Cs.

One additional thing that may be working there is a status check of Internet connectivity the router does. Some can indeed do that just by ICMP requests to their own home sites. If they see that's not working, the router could then report that your Internet connection is down if it does not make any other checks except that one (but the well designed ones should not relay on a single check-point for determining connectivity status).

  • 2
    That might be true, but in this case it's totally poorly designed if it makes a new DNS query every 15 seconds. – Esa Jokinen May 8 at 10:04
  • Indeed. Some routers I've encountered have options like weekly or monthly update check, some let you specify the number of days/hours between checks. Some can use a keep-alive status check too. I'll complete this also in the answer. – Overmind May 8 at 12:37
  • One thing that you can do to analyze the situation better is to put Wireshark between your router and your WAN connection to see what the content of the request is. – MechMK1 May 8 at 12:43
  • 1
    True, but port mirroring a home router WAN is not too easy to accomplish. Some routers support port mirroring; but the problem is for the ones that don't. – Overmind May 8 at 12:57
  • I have a hard time believing it's performing a simple update check 4x /minute, as Esa notes. I'll check again for update options and monitor what happens the next couple days, but I'm hoping for something more specific so I'll give it a couple days before accepting an answer. – brichins May 8 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.