Live data from Hacker News

TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

ctrl.blog

201–210 of 245 posts

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#201

slightly off topic, can anyone recommend a good router for home use? It seems like every major brand router is just awful.

I find that my Synology router has been rock-solid and extremely performant. I have the RT2600ac and have been quite happy with it, and it has a nice web interface that you can configure automatic updates on, so it can even be distributed to people who aren't quite as network savvy.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#202
post #62
post #24

Earlier quoted context omitted.

Speaking from experience, it is good. Takes a bit of networking know-how to set it up though, and you still need a router. Their consumer oriented stuff like the AmpliFi is quite excellent too and a bit friendlier. I use an Edgerouter Lite, a Mikrotik switch and UniFi APs for myself and was so pleased I bought the AmpliFi mesh for my parents.

I have a similar setup, without the switch and the Unifi APs are just excellent. Smooth setup, great range. So, if you can run a cable, I second Unifi. Op, if you can not run a cable, maybe look into a mesh network. Repeaters "loose" about half of the bandwidth anyway, a mesh might be good alternative. If you want to set up an open source enviroment, there is libremesh ( http://libremesh.org ). If you just want to bu…

> Op, if you can not run a cable, maybe look into a mesh network. Repeaters "loose" about half of the bandwidth anyway, a mesh might be good alternative.

Mesh network simplifies setting up many repeaters, but it "looses" bandwidth the same way (unless you connect it via cable/other frequency band) as repeaters.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#203

Earlier quoted context omitted.

My response was tongue in cheek but seriously I recommend budgeting a VM or Raspberry PI to run their controller software which offers the most configuration options. https://www.ubnt.com/download/unifi/

The Unifi cloud stick isn't that much more expensive than a PI, and is probably the least amount of work to set up a dedicated controller. I use an Atom based PC stick that I had lying around to run the controller (on Windows) and it works great.

I mistakenly thought the cloud key ran a lesser version of unifi than the distribution found on their website, however googling around implies it's the same version. So I suppose budget for a cloud key or a pi. A raspberry Pi 3 is 64 bit, runs Fedora natively and can serve up other functions beyond the key. So I lean towards the Pi but if they're functionally equivalent I suppose it's down to personal preference.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#204

Earlier quoted context omitted.

My response was tongue in cheek but seriously I recommend budgeting a VM or Raspberry PI to run their controller software which offers the most configuration options. https://www.ubnt.com/download/unifi/

A Raspberry Pi probably won't do. The controller requires MongoDB which itself is no longer supports the 32 bit architecture which most RPis are running on.

Pi 3 is 64 bit and natively supported in Fedora.

https://fedoraproject.org/wiki/Architectures/ARM/Raspberry_P...

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#205
post #130

firmware sends six DNS requests and one NTP query every 5 seconds (...snip...) TP-Link has hardcoded the following non-configurable NTP servers and server pools in their firmware: (...snip...) au.pool.ntp.org, nz.pool.ntp.org Wait... so TP-Link is effectively DDoSing NTP pool? Also, as pointed out in another thread here, vendor using country prefix instead of applying for their own prefix is a violation of: http://ww…

Would it be possible for the NTP server to detect what type of device/OS is sending the request and block it (ie: could au/nz.pool.ntp.org servers block all TP-Link requests to teach them a lesson)?

If they can't do that maybe they can just detect IPs that are making requests every 5 seconds as the TP-Link products are doing and block those since they're in violation of the once-every-10-minutes-maximum rule for the NTP servers)?

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#206
post #9

PSA Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org . Check if your device has support here - https://lede-project.org/toh/start LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

Anyone care to explain the pro/cons of DD-WRT vs Tomato vs OpenWRT vs LEDE vs etc?

I love my Tomato router, I'm on my second in about 7 years. Asus N66u I think. The first I bought and configured myself, which was a tiny bit of pain finding the right binary, etc. The router I'm using now I bought from FlashRouters.com at a fairly high margin above what I could buy the router alone, but they're fast and I trust them. I just recently bought a backup router from them too, and preconfigured it for minimal downtime should the current one break.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#207
post #205
post #130

firmware sends six DNS requests and one NTP query every 5 seconds (...snip...) TP-Link has hardcoded the following non-configurable NTP servers and server pools in their firmware: (...snip...) au.pool.ntp.org, nz.pool.ntp.org Wait... so TP-Link is effectively DDoSing NTP pool? Also, as pointed out in another thread here, vendor using country prefix instead of applying for their own prefix is a violation of: http://ww…

Would it be possible for the NTP server to detect what type of device/OS is sending the request and block it (ie: could au/nz.pool.ntp.org servers block all TP-Link requests to teach them a lesson)? If they can't do that maybe they can just detect IPs that are making requests every 5 seconds as the TP-Link products are doing and block those since they're in violation of the once-every-10-minutes-maximum rule for the…

Out-of-the-loop: what products are using TP-Link?

Aside: maybe there should be a governing body for comm protocol behavior? (Semi sarcastic)

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#208
post #205

Earlier quoted context omitted.

Would it be possible for the NTP server to detect what type of device/OS is sending the request and block it (ie: could au/nz.pool.ntp.org servers block all TP-Link requests to teach them a lesson)? If they can't do that maybe they can just detect IPs that are making requests every 5 seconds as the TP-Link products are doing and block those since they're in violation of the once-every-10-minutes-maximum rule for the…

Out-of-the-loop: what products are using TP-Link? Aside: maybe there should be a governing body for comm protocol behavior? (Semi sarcastic)

TP-link is a manufacturer of multiple devices and an OEM for others. I would imagine, if consistent across firmwares, there are a lot of requests being made. https://en.wikipedia.org/wiki/TP-Link

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#209

Earlier quoted context omitted.

Just to be clear, OpenWRT isn't 100% abandoned, but it's basically just a handful of sporadic package version bumps and backported bug fixes, which might not ever make it into an official numbered release. If the counts on GitHub are accurate/comparable, LEDE has almost 2000 more commits than OpenWRT. The OpenWRT website also seems to be semi-abandoned (the front page has had a spam post on it for over a month; it lo…

I naively bought the Linksys WRT 1900AC about when it released because it claimed dd-wrt support at release. Then the dd-wrt folks mentioned that Linksys never actually gave them hardware ... and if I recall, hadn't really been included in the plans to support it at all. So then I waited and found whenever I looked for the dd-wrt firmware, it always had lots of caveats and known issues. I gave up. Shelved it and boug…

I use ddwrt on my wrt1900ac. its quite fine, but I may try LEDE anyway

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#210

Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex. If the SSID and security passphrases match, clients will roam seamlessly between the different APs. I suspect the reason people buy repeaters is that they don't realise that this is possible, or they don't want additional cabling. Repeaters add latency and I can't…

Most TP-Link repeaters can act in Access Point mode. It uses the same firmware and has the same bugs no matter what mode it’s set to use.
Post reply on HN