Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

ctrl.blog

Post reply on HN
Print view View original

51–60 of 245 posts

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#51

Post by ktta »

cthalupa wrote: post #48
metafunctor wrote: post #46

Earlier quoted context omitted.

Seems to me like 715 MB is about right, at least it's not off by a factor of 10. There's no way you could fit six DNS queries and a couple of NTP queries into 138 bytes. As pointed out by jlgaddis, based on the numbers in the article given for the size of DNS & NTP requests and responses, seems like the author meant 1380 bytes. That gets you about 715 MB (or about 682 MiB).

My third edit included a bit more on this - I'm closer to 600 bytes total than 1380. A few of them are sitting at closer to 80 bytes for a request+response for DNS, etc. With a quick while loop and tcpdump, I'm seeing the number as being off by about 2x from my testing. My DNS numbers are all basically half his - all of my requests are sub 40 bytes, responses are all sub 80, some are sub 60. My NTP query and response…

Your DNS numbers are off because you aren't counting IP and UDP headers

See my edit - https://news.ycombinator.com/item?id=15912467

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#52

Post by jnbiche »

joering2 wrote: post #25
alpb wrote: post #4

My most recent frustration with TP-LINK was they they DO NOT provide their firmware updates over HTTPS. They do not provide checksums for their firmware files either. (When I asked for these things, their support weren't helpful on Twitter.) So you're expected to download some unsigned binary over an untrusted connection and trust that with all your traffic. Definitely not buying TP-LINK next time. Good to know this…

Given most of your traffic goes via HTTPS pipes, that over-reacting a little, no?

No. The point is, you could be downloading a corrupted copy of the firmware with exploits, for example. If your firmware has such exploits, what good is the fact that most of your traffic goes over https?

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#53

Post by Kenji »

ktta wrote: post #9

PSA Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org . Check if your device has support here - https://lede-project.org/toh/start LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

I work with OpenWRT/LEDE and compile it myself. Can confirm: A very pleasant experience.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#54

Post by King-Aaron »

xyzzy_plugh wrote: post #49
bubblethink wrote: post #29

Earlier quoted context omitted.

>You will be able to do a lot more with your router and they have quick security fixes Just a counter point to this. Lede on its own doesn't have a very smooth in place upgrade system. If you are in the loop, sure you can do upgrades, but most people would never log in to their routers after setting it up. I think something like google wifi is not a bad solution either, with the obvious privacy tradeoff. It runs chro…

Chromium updates require a reboot to take effect, right? How does Google WiFi reliably update without service interruptions?

I don't use the device so this is purely speculation, though I would assume they'd have configurable setting to push/apply updates at off-peak / night times?

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#55

Post by ktta »

bubblethink wrote: post #29
ktta wrote: post #9

PSA Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org . Check if your device has support here - https://lede-project.org/toh/start LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

>You will be able to do a lot more with your router and they have quick security fixes Just a counter point to this. Lede on its own doesn't have a very smooth in place upgrade system. If you are in the loop, sure you can do upgrades, but most people would never log in to their routers after setting it up. I think something like google wifi is not a bad solution either, with the obvious privacy tradeoff. It runs chro…

I realize people's opinions differ on this, but having Google's wifi router is one of the most privacy compromising things one can do.

Security wise, sure, great idea. But there's so much data to collect at the router level. From wireless MAC addresses (which it already does), and to every single IP address visited by every device in the household.

I might sound paranoid, but with continuous news of Google's privacy intrusive choices on Android, iOS etc. I will not trust them with that data, ever.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#56

Post by cthalupa »

ktta wrote: post #51
cthalupa wrote: post #48

Earlier quoted context omitted.

My third edit included a bit more on this - I'm closer to 600 bytes total than 1380. A few of them are sitting at closer to 80 bytes for a request+response for DNS, etc. With a quick while loop and tcpdump, I'm seeing the number as being off by about 2x from my testing. My DNS numbers are all basically half his - all of my requests are sub 40 bytes, responses are all sub 80, some are sub 60. My NTP query and response…

Your DNS numbers are off because you aren't counting IP and UDP headers See my edit - https://news.ycombinator.com/item?id=15912467

Even using -e and looking at length I'm still significantly under 1380 bytes.

dig/ntpq on osx.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#57

Post by ktta »

cthalupa wrote: post #56
ktta wrote: post #51

Earlier quoted context omitted.

Your DNS numbers are off because you aren't counting IP and UDP headers See my edit - https://news.ycombinator.com/item?id=15912467

Even using -e and looking at length I'm still significantly under 1380 bytes. dig/ntpq on osx.

Can you take a look at the edit and comment on where your numbers differ exactly? I tried to be as accurate as possible. I used the busybox_NTPD from https://busybox.net/downloads/binaries/

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#58

Post by bubblethink »

xyzzy_plugh wrote: post #49
bubblethink wrote: post #29

Earlier quoted context omitted.

>You will be able to do a lot more with your router and they have quick security fixes Just a counter point to this. Lede on its own doesn't have a very smooth in place upgrade system. If you are in the loop, sure you can do upgrades, but most people would never log in to their routers after setting it up. I think something like google wifi is not a bad solution either, with the obvious privacy tradeoff. It runs chro…

Chromium updates require a reboot to take effect, right? How does Google WiFi reliably update without service interruptions?

Kernel updates do need a reboot. That's there for any linux based device. There are some improvements in kernel live patching. Not saying that google wifi, or any router uses them.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#59

Post by herpderperator »

Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex. If the SSID and security passphrases match, clients will roam seamlessly between the different APs. I suspect the reason people buy repeaters is that they don't realise that this is possible, or they don't want additional cabling.

Repeaters add latency and I can't imagine any network engineer would ever recommend one.

Re: TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

#60

Post by JetSpiegel »

jml7c5 wrote: post #50
jlgaddis wrote: post #39

Earlier quoted context omitted.

OpenWRT/LEDE firmware is nice. I think I first used it with the (original) WRT54G. The future of the project is uncertain, however. They may or may not be around much longer.

>The future of the project is uncertain, however. They may or may not be around much longer. Can you elaborate on this?

The mailing lists mention LEDE will merge back to the OpenWRT branding, but that was months ago, and the OpenWRT site is funky.
Post reply on HN