Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

ctrl.blog

Post reply on HN
Print view View original

221–230 of 245 posts

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#221

Post by craftyguy »

muxator wrote: post #182
ktta wrote: post #9

PSA Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org . Check if your device has support here - https://lede-project.org/toh/start LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

On LEDE, it seems that there is always an hardcoded DNS fallback to 8.8.8.8. I see it in my logs, even if none of my configuration files mentions it.

Wow, that's unfortunate. Are you sure no clients on your network aren't configured to use Google dns servers?

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#222

Post by linsomniac »

Forbo wrote: post #213
linsomniac wrote: post #211

I ran a public NTP server for around a decade. I finally stopped, but these sorts of vendor abuse weren't the reason why. We started running them before the NTP pool (though we eventually did include our servers in the pool). The worst it got was a largish regional ISP had put our servers in their CPE, and one day they had an event where they rebooted all of their CPE at once. That caused a noticeable spike in our ne…

NTP uses UDP, so he was probably the victim of a spoofed NTP request amplification attack. He probably didn't have clients that we're actually requesting the time, the requests were just spoofed to look like they came from his IP.

My recollection was that the volume coming from this one site was tiny, not like a DDoS. I don't recall if he said as much or if I was reading between the lines, but it sounded like he had just set up some sort of IDS, and it reported this traffic as an attack, and he just took that at face value.

We did have some UDP multiplication attacks at other times, mostly on our authoritative DNS servers. I don't recall that we ever had any against our NTP servers that I noticed. But we did block the broadcast address so the best multiplication vector was via DNS requests, IIRC the NTP responses were fairly short.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#223

Post by lunchables »

zoe1337 wrote: post #116
herpderperator wrote: post #59

Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex. If the SSID and security passphrases match, clients will roam seamlessly between the different APs. I suspect the reason people buy repeaters is that they don't realise that this is possible, or they don't want additional cabling. Repeaters add latency and I can't…

Powerline Ethernet might be a solution for the cable problem. I'm thinking of connecting the extra AP(s) through Powerline Ethernet to the router if there is no copper Ethernet available.

That's exactly what I did and it's worked out great. I'm getting upwards of 300Mb/s using powerline adapters. They were netgear brand, I apologize I don't remember the model, but I think it had "1200" in it. A lot will depend on what else you have on the breaker, from what I understand. But for my purposes the performance was more than adequate.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#224

Post by lunchables »

JustSomeNobody wrote: post #140
zoe1337 wrote: post #116

Earlier quoted context omitted.

Powerline Ethernet might be a solution for the cable problem. I'm thinking of connecting the extra AP(s) through Powerline Ethernet to the router if there is no copper Ethernet available.

Powerline Ethernet is not really a good solution either. If you don't use your phone jacks, take the cover off one and check if it's actually using Cat5 or greater. You can then use those for network if you replace the connectors.

You really shouldn't make blanket statements like that. While I'd definitely recommend using existing category 5 wiring if it's available, I'm getting close to 300Mb/s via powerline adapters, so it really comes down to your individual situation. For me it's been more than adequate.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#225

Post by JdeBP »

cthalupa wrote: post #15
0x0 wrote: post #10

Earlier quoted context omitted.

Don't forget that those 715mb you take have to be delivered by someone running those servers at the other end, multiplied by the number of devices. Don't be a vandal on the internet. Don't be the reason for why we can't have nice things like community ntp pools.

If the NTP pool has an issue with what TP-Link is doing, they should talk to TP-Link. If TP-Link is unresponsive to their concerns, then they should be public about it. It is not the responsibility of random consumers to know about how two other parties interact with each other. This appears to be entirely a supposition that the NTP pool cares that TP-Link is doing this, without any evidence from the actual people in…

Ask Bjørn Hansen encouraged TP-Link to comply with the vendors system and get its own hostname, back in January 2017.

* https://community.ntppool.org/t/software-and-devices-without...

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#226

Post by jburgess777 »

cheald wrote: post #147
tambourine_man wrote: post #135

Earlier quoted context omitted.

Anyone care to explain the pro/cons of DD-WRT vs Tomato vs OpenWRT vs LEDE vs etc?

LEDE is basically an OpenWRT fork which is being actively developed. The biggest draw is that it's actively developed, and managed in a Linux-style package manager setup, rather than monolithic baked firmwares that you have to flash wholesale. Patching against things like KRACK was as simple as just invoking the package manager. DD-WRT and Tomato are both old tried-and-true alternatives to vendor firmwares, and they…

The plan is for the LEDE and OpenWRT projects to "remerge" but the implementation is taking some time:

https://lwn.net/Articles/722135/

http://lists.infradead.org/pipermail/lede-adm/2017-November/...

http://lists.infradead.org/pipermail/lede-dev/2017-December/...

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#227

Post by nas »

tambourine_man wrote: post #135
ktta wrote: post #9

PSA Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org . Check if your device has support here - https://lede-project.org/toh/start LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

Anyone care to explain the pro/cons of DD-WRT vs Tomato vs OpenWRT vs LEDE vs etc?

The big one for me is that LEDE uses a recent kernel. DD-WRT and Tomato use the kernel that was provided by the hardware vendor. They have an easier job to get things running because most hardware vendors have some crazy (perhaps binary only) kernel modules.

When buying hardware, look at the LEDE hardware support list. Recently I have bought a TL-WDR4300 (get right version) and a Buffalo Airstation N600 router. LEDE runs good on these and the router has enough flash and RAM. Running hardware vendor firmware is not good, IMHO.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#228

Post by jlgaddis »

lovelearning wrote: post #193
jlgaddis wrote: post #86

Earlier quoted context omitted.

> The site openly disclosed that they use affiliate links to amazon. Did it? I was on an iPad and only realized they were affiliate links after I clicked on one and it took to Amazon. Immediately, I looked at the URL to see if there was a referral tag in there. I then went back and noticed "DISCLOSURE" at the very bottom, in the footer, but I don't recall seeing any mention of it before that. > If you think that all…

I wanted to ignore this since I don't enjoy subjective arguments, but since you seem to be virtue signalling about disclosures, I'd like to point out that your own page with Amazon affiliate links [ http://evilrouters.net/bookshelf/ ] does not disclose your affiliation to Amazon (which is itself a violation of section 5 of the Amazon affiliate program agreement), nor does your DISCLOSURE page (whose link is also at t…

Thanks for pointing that out. With the exception of a couple spontaneous, hastily written blog posts, that blog has been pretty neglected for about the last ~5 years. I've been meaning to remove the Adsense ads and add HTTPS for a long while too, but I haven't got around to doing either. Before just now, it's probably been several months since I even looked at that site.

Anyways, the "disclosures" page has no references to Amazon because I removed them several years ago when I quit being a part of the Amazon Affiliate program. I thought I had removed the affiliate tags as well but apparently not. They were still there but they haven't been valid for at least three or four years now (and, thus, not generating any commissions).

Here's a screenshot showing that the account was closed: https://imgur.com/c3rmZ5F

Regardless, I have removed them from the page. The page is cached and I don't remember the magic incantation to force varnish to purge the cached version but rest assured it'll get refreshed in the near future.

I'm sorry you had to spend your time searching through my web sites to try to find something that made me look hypocritical. Also, I'll point out that I don't go around posting links to that "bookshelf" page on HN comments. That is what would have made my statements hypocritical, not the fact that I had affiliate links on some random web page somewhere.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#229

Post by jlgaddis »

Xylakant wrote: post #134
alsetmusic wrote: post #122

Earlier quoted context omitted.

> I count single digit mentions in 1669 days that procotor is registered on HN. That would be lousy self promotion. Lousy of not, it’s still self-promotion. This is true whether it occurs once or many times. > I believe that proctor genuinely believes he built something useful and wants to share it. I agree. > The snark in jlgaddis post rubs me the wrong way. Clearly. However, you aren’t defending your accusation of…

> Lousy of not, it’s still self-promotion. This is true whether it occurs once or many times. If a few mentions of something you built counts as self promotion, then even the description and the link to the blog that jlgaddis has on his profile page is self-promotion. It promotes a blog that he writes, possibly to further his professional career. > Clearly. However, you aren’t defending your accusation of jealousy. J…

It's really not "jealousy" but you're free to believe that if you'd like.

Would you feel better if I removed the info in my HN profile?

Note also that blog has been mostly neglected for the last ~5 years.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#230

Post by frankzinger »

wnevets wrote: post #199

slightly off topic, can anyone recommend a good router for home use? It seems like every major brand router is just awful.

As others have said, check out Mikrotik.

I recently bought https://mikrotik.com/product/RB952Ui-5ac2nD-TC. It was much cheaper than my previous stock Netgear router but it's orders of magnitude better.

This live demo of their web UI at http://demo.mt.lv/ and http://demo2.mt.lv/ should give you a good idea of what you get.

Post reply on HN