TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

https://www.ctrl.blog/entry/tplink-aggressive-ntp

by phikai • 9 years ago

485 237 9 years ago

xamlhacker• 9 years ago

Well I run a TP-link repeater and now thinking of getting something better. Someone know any routers or repeaters with reputation for good firmware?

ktta8• 9 years ago

Why not use LEDE firmware? It's beats most consumer routers' firmware by a long shot. Search your router's model here - https://lede-project.org/toh/start

cbhl• 9 years ago

If you trust Google, consider buying into Google Wifi mesh routers.

If not, consider eero.

mtgx• 9 years ago

Amplifi HD seems better in terms of range and signal strength.

Thlom• 9 years ago

The Ubiquity Unifi stuff looks good and not very expensive.

gh02t• 9 years ago

Speaking from experience, it is good. Takes a bit of networking know-how to set it up though, and you still need a router. Their consumer oriented stuff like the AmpliFi is quite excellent too and a bit friendlier.

I use an Edgerouter Lite, a Mikrotik switch and UniFi APs for myself and was so pleased I bought the AmpliFi mesh for my parents.

dawnerd• 9 years ago

My entire house uses them exclusively and they’re rock solid (as long as you have latest firmware, adopting old stock can be .... interesting).

Also no need for the cloud controller as you can run t inside a docker and have a fully self hosted solution.

danesparza3• 9 years ago

Speaking from experience, Unifi is rock solid. I've got 2 Unifi access points and a gigabit PoE switch in my house.

Troy Hunt also had a great article detailing his work with Unifi gear as well: https://www.troyhunt.com/ubiquiti-all-the-things-how-i-final...

rebolek• 9 years ago

Turris Omnia is nice router with auto update and strong focus on security. https://omnia.turris.cz/en/

Asooka• 9 years ago

I've been very satisfied with my MikroTik router.

alpb• 9 years ago

My most recent frustration with TP-LINK was they they DO NOT provide their firmware updates over HTTPS. They do not provide checksums for their firmware files either. (When I asked for these things, their support weren't helpful on Twitter.)

So you're expected to download some unsigned binary over an untrusted connection and trust that with all your traffic.

Definitely not buying TP-LINK next time. Good to know this there's a bandwidth problem like this!

problems2• 9 years ago

What makes you think they're unsigned? Surely there's at least some basic checksumming if not cryptographic signatures inside of that blob? There's no reason to even bother with delivering it over https if you put a good signature on the blob itself.

DSMan195276• 9 years ago

I would assume it does not do those things, or else creating/flashing custom firmware like DD-WRT would presumably be impossible. They could be doing some verification in the firmware itself, but obviously that only saves you from bad downloads - anybody serving you up a malicious firmware can easily just serve one up without the verification checks inside.

snuxoll• 9 years ago

TP-Link does a pretty good job on basic Layer 3 Lite switches and desktop wireless cards, but the junky software on their routers and repeaters is enough to make me not use them. Unfortunately they do the same thing worth firmware upgrades for their switches as well, no signatures, no hashes, no TLS.

flyinghamster• 9 years ago

Good to know. While I've liked their dumb switches, if they can't be bothered to secure their firmware downloads, there's no way I'm buying one of their "smart" products.

joering2• 9 years ago

Given most of your traffic goes via HTTPS pipes, that over-reacting a little, no?

jnbiche• 9 years ago

No. The point is, you could be downloading a corrupted copy of the firmware with exploits, for example. If your firmware has such exploits, what good is the fact that most of your traffic goes over https?

ce42• 9 years ago

Just install https://lede-project.org firmware, the successor of OpenWRT.

tobbyb• 9 years ago

It's not so clear cut. You need to benchmark before and after.

Often acceleration modules on Broadcom, Qualcomm, Mediatek etc are proprietary and without acceleration in OpenWrt/Lede the router is going to be dog slow.

The wifi modules are also proprietary and need be well supported by Openwrt/Lede or you will see throughput drops.

Of late it's just best to use what's in the router and not bother. And we move to faster connections on consumer routers with slow main SOCs the proprietary accelerators will become even more important.

cleeus2• 9 years ago

I consider that a feature ;)

TP-Link plastic routers have nice cheap hardware and they make it really easy for you to flash it with LEDE/OpenWRT.

mort963• 9 years ago

Well, it's not a feature. You can both provide official firmware over HTTPS (or provide checksums for them, or both), and let people flash custom firmware, at the same time.

naasking• 9 years ago

Yikes. I've generally had good experiences with TP-LINK, so this is a bummer. But as others have noted, open source firmwares are available, so there's an upside.

d2wa5• 9 years ago

Did you see this one too? https://www.ctrl.blog/entry/tplink-firmware-outdated-downloa...

cthalupa8• 9 years ago

I use a TP-Link travel router while on the road to get access for all of my devices in hotels that have device caps, and for my Android TV devices which don't gracefully handle hotel login prompts.

I have to say that the convenience, ease of use, and reliability of the product far outweighs any concerns I have over ~715MB over the course of a month. It boots quickly once plugged in, it reliably handles 4-5 devices utilizing it as a bridge for the hotel wifi, and I have never had it crash, give me any sort of wonky behavior, or anything of that nature.

jsjohnst2• 9 years ago

I have to say that the convenience, ease of use, and reliability of the product far outweighs any concerns I have over ~715MB over the course of a month.

So your convenience trumps the impact you’re causing to global infrastructure? Yes, you’re just one among millions, but still a slippery slope.

cthalupa8• 9 years ago

So your convenience trumps the impact you’re causing to global infrastructure

Honestly? Yes.

Should I want TP-Link to fix it? Maybe. Should pressure be put on TP-Link to fix it? Yes.

But not by consumers. It isn't the responsibility of a random consumer that has no idea what an NTP server even is to understand whether or not the TP-Link router is going the "right thing" for all sorts of use cases they've never even heard of it.

From a consumer perspective, does TP-Link build a good product? Yes. And that's all consumers care about.

The pragmatic reality of the situation is if this is an issue, the public service providers need to do something about it.

You cannot expect consumers to worry about or even know about this sort of thing. They don't care. They'll never care. This blog post won't make these random consumers that see it as a highly rated product on e-commerce websites care. TP-Link won't care when the niche population of people that care about this don't buy their product because we're not the market.

If the NTP pool cares about what TP-Link is doing, they should reach out to TP-Link about it, and if there's no co-operation, be public about it.

Pissing into the wind on a random 3rd party blog about how consumers should switch because of something 99.9% of consumers don't care about isn't going to accomplish anything, whether we a conscientious net citizens should care or not.

jlgaddis10• 9 years ago

He's actually not causing any "impact" at all.

The firmware of some TP-Link repeaters — but not routers — including all 2017 models ... --TFA

0x02• 9 years ago

Don't forget that those 715mb you take have to be delivered by someone running those servers at the other end, multiplied by the number of devices. Don't be a vandal on the internet. Don't be the reason for why we can't have nice things like community ntp pools.

cthalupa8• 9 years ago

If the NTP pool has an issue with what TP-Link is doing, they should talk to TP-Link. If TP-Link is unresponsive to their concerns, then they should be public about it. It is not the responsibility of random consumers to know about how two other parties interact with each other.

This appears to be entirely a supposition that the NTP pool cares that TP-Link is doing this, without any evidence from the actual people in charge of it are concerned. As best I can tell, this blog is not run by Ask Bjørn Hansen and neither he nor the ISC have voiced any concerns here.

jlgaddis10• 9 years ago

Don't be the reason ...

He's not the reason.

As TFA points out, it's TP-Link repeaters and explicitly "not routers" that are affected.

jlgaddis10• 9 years ago

I've got a couple of MR-3020 "travel routers" myself, though I run OpenWRT on 'em. They're pretty decent little boxes and well worth the $15 or so that I paid for 'em.

cthalupa8• 9 years ago

I've got the successor, the TL-WR902AC

Looks like LEDE might support them, though when I purchased it, it did not. I might check that out.

0x02• 9 years ago

Reminds me about the D-Link vs phk NTP drama years ago https://slashdot.org/story/06/04/07/130209/d-link-firmware-a...

edent• 9 years ago

Wow! 11 years ago Dlink were the ones abusing NTP https://m.slashdot.org/story/67096

Strange how these "mistakes" keep cropping up. Is it laziness, malice, or just ignorance?

yeukhon• 9 years ago

Laziness and ignorance (probably not even knowing what they were doing other than just using these ntp servers) at the beginning. I bet someone just “copied and pasted”.

danesparza3• 9 years ago

Perhaps it's the same developers making the same stupid mistakes.

ktta8• 9 years ago

PSA

Anyone with commodity routers, repeaters, etc. please check out LEDE project https://lede-project.org. Check if your device has support here - https://lede-project.org/toh/start

LEDE firmware is amazing. You will be able to do a lot more with your router and they have quick security fixes. The recent krack vulnerability was fixed within 2 days after the announcement.

skeleton• 9 years ago

I'm interested in installing a different firmware on my home router, but there are many offerings. Is there any reason you recommend LEDE over the others? (e.g. Tomato)

bubblethink3• 9 years ago

Maybe the name LEDE is not familiar to you, but LEDE is an openwrt fork, which is essentially going to get named to openwrt again through a merge since that's where most of the openwrt work is happening. From the various open or semi-open firmware, LEDE is the most active and open I think. Various other firmware will still be quite tied to vendor binary drivers.

ktta8• 9 years ago

Tomato, DD-WRT, etc. try to be extremely user friendly. Not that LEDE doesn't, but people who have some technical expertise tend to benefit a lot more from LEDE with all their packages. Especially if you can compile an image yourself (it is pretty easy on linux), then you can have all the features tailored to your preference.

jlgaddis10• 9 years ago

OpenWRT/LEDE firmware is nice. I think I first used it with the (original) WRT54G.

The future of the project is uncertain, however. They may or may not be around much longer.

bubblethink3• 9 years ago

You will be able to do a lot more with your router and they have quick security fixes

Just a counter point to this. Lede on its own doesn't have a very smooth in place upgrade system. If you are in the loop, sure you can do upgrades, but most people would never log in to their routers after setting it up. I think something like google wifi is not a bad solution either, with the obvious privacy tradeoff. It runs chromium os, and will update reliably on its own.

xyzzy_plugh• 9 years ago

Chromium updates require a reboot to take effect, right? How does Google WiFi reliably update without service interruptions?

ktta8• 9 years ago

I realize people's opinions differ on this, but having Google's wifi router is one of the most privacy compromising things one can do.

Security wise, sure, great idea. But there's so much data to collect at the router level. From wireless MAC addresses (which it already does), and to every single IP address visited by every device in the household.

I might sound paranoid, but with continuous news of Google's privacy intrusive choices on Android, iOS etc. I will not trust them with that data, ever.

proctor• 9 years ago

Also, I maintain a page[0] that lists the top routers with support for openWrt and DD-wrt.

http://rooftopbazaar.com/routerfirmware/

jlgaddis10• 9 years ago

Nice referral links on your page. I see from your comment history that you've spammed HN with it several times in the past as well.

---

Edit: To be clear, there's nothing inherently wrong with affiliate links. To me, though, it's the same as someone here mentioning their product or service in a comment without disclosing their affiliation.

It's one thing to tell another person "The FooBar 9000 is a good router.". It's quite another to say, "The FooBar 9000 is the BEST router on the market. Oh, look, here's Joe. He sells those and you can buy one from him right now.", without mentioning you have previously worked out a deal with Joe.

It's not the affiliation that's the issue. It's the lack of transparency about the affiliation. (And, in this case, for me personally, it's that the OP apparently tries to work in a link to his page anywhere he can in HN conversations.)

konart• 9 years ago

Is there any reason to switch from OpenWrt yet?

gsich• 9 years ago

OpenWrt was basically dead after devs switched to LEDE.

But they are remerging again, it just takes some time, so use LEDE if you install something now.

lmns2• 9 years ago

Security patches. OpenWRT hasn't had any in the past year.

nerdponx• 9 years ago

FWIW this only affects repeaters, not routers.

philjohn6• 9 years ago

And repeaters are also supported by Lede, the TPLink RE450 being one such (I should know, I run a totally LEDE stack at home, and have an RE450 to get the signal better upstairs).

stordoff2• 9 years ago

FWIW, it can be worth checking beyond whether or not your device is _supported_. I had DD-WRT running on an ASUS RT-AC68U for a while, and ended up switching back to a fork of the official firmware (Asuswrt-Merlin) for better performance once I upgraded to a >100Mbps WAN connection (IIRC it was something to do with hardware-accelerated NAT).

philjohn6• 9 years ago

There's a patch to enable Qualcomm FastPath in LEDE, this offloads simpler TCP and UDP traffic from the Kernel stack and gets me 960Mbps LAN to WAN on a Netgear R7800.

philjohn6• 9 years ago

This. I've got a TPLink Repeater (RE450) and a Netgear R7800 router, both are running LEDE and have given me a slew of great features out of the box, and many more that can be installed after the fact using the packaging system.

There's also a third router, an old TP-Link 1043ND running as a wireless bridge to connect devices in my AV setup, once again running LEDE.

adminadminadmin• 9 years ago

Why LEDE over Merlin for ASUS?

tambourine_man• 9 years ago

Anyone care to explain the pro/cons of DD-WRT vs Tomato vs OpenWRT vs LEDE vs etc?

cheald• 9 years ago

LEDE is basically an OpenWRT fork which is being actively developed. The biggest draw is that it's actively developed, and managed in a Linux-style package manager setup, rather than monolithic baked firmwares that you have to flash wholesale. Patching against things like KRACK was as simple as just invoking the package manager.

DD-WRT and Tomato are both old tried-and-true alternatives to vendor firmwares, and they require less tinkering to get into the state that you want, but they both tend to have weird crufty edge cases that never get properly fixed and don't seem to have any clear direction or leadership - they are both a hodgepodge of forks that you have to spend time digging through hundred-page forum threads to find information about. Development schedules are sporadic, and you often end up with dozens of potential builds in varying states of beta and testing which fix this or that but break this or that other thing. When they work, they're great, but my experience with LEDE has been consistently superior than my experience with DD-WRT or Tomato.

jimmies2• 9 years ago

LEDE has a very active anti-bufferbloat research people working with it.

LEDE has, in general, active, managed, and unified development. You'd have to hunt down a specific Tomato/DD version that works for you. Sometimes the latest version of DD/Tomato works, sometimes it doesn't. LEDE? Just download the latest stable release, done.

creeble• 9 years ago

I love my Tomato router, I'm on my second in about 7 years. Asus N66u I think. The first I bought and configured myself, which was a tiny bit of pain finding the right binary, etc. The router I'm using now I bought from FlashRouters.com at a fairly high margin above what I could buy the router alone, but they're fast and I trust them. I just recently bought a backup router from them too, and preconfigured it for minimal downtime should the current one break.

nas• 9 years ago

The big one for me is that LEDE uses a recent kernel. DD-WRT and Tomato use the kernel that was provided by the hardware vendor. They have an easier job to get things running because most hardware vendors have some crazy (perhaps binary only) kernel modules.

When buying hardware, look at the LEDE hardware support list. Recently I have bought a TL-WDR4300 (get right version) and a Buffalo Airstation N600 router. LEDE runs good on these and the router has enough flash and RAM. Running hardware vendor firmware is not good, IMHO.

muxator2• 9 years ago

On LEDE, it seems that there is always an hardcoded DNS fallback to 8.8.8.8. I see it in my logs, even if none of my configuration files mentions it.

craftyguy• 9 years ago

Wow, that's unfortunate. Are you sure no clients on your network aren't configured to use Google dns servers?

guftagu• 9 years ago

It seems like they support every model but exactly mine. I'm running TP-LINK TL-WR845N

linkmotif• 9 years ago

I put openwrt on my $20 tp-link router that couldn’t even handle a single torrent and now it functions like a beast. Installation was so easy. I just downloaded the openwrt firmware file and uploaded it using the tp-link web ui like an official update.

Software!

acidburnNSA• 9 years ago

Thanks! I have been running DD-WRT for a while and was displeased that their updates were unofficial builds served over HTTP, ugh. LEDE looked right up my alley and this evening I went ahead and installed it from the SSH window of my DD-WRT install. After a few hours I had the OpenVPN server in "road-warrior" mode with all firewall rules functioning and now I just finished up getting my USB drive mounted on it. It's really slick, thanks a ton for the suggestion!!

kercker• 9 years ago

Update: According to ktta (https://news.ycombinator.com/item?id=15912467), there is mistake in my calculation too.

"138KB * 24 * 3600 / 5" should be 2.3287GB per day. And it's 2.3287GB * 30 per month.

Update 2: "For comparison, a 5-minute check would be considered a pretty aggressive checking interval, and would only consume 1,37 MB per month. Instead, TP-Link goes through the same amount of data in just 82 minutes."

This assertion from the article has multiple errors too.

-----------------------------------------------------

The whole argument of the author is built on a flawed calculation by the author and the author exaggerated the number by a factor of 10.

715MB/month in the title and the article should be 71.5MB/month according to other information provided by the author.

According to the author, "TP-Link product is using about 138 KB every 5 seconds — or 23,85 MBs per day — on timekeeping."

23,85 MBs per day is not right, because 138KB * 24*3600/5 is about 2.328 MBs not 23,85 MBs.

ktta8• 9 years ago

Also I think it is 138 B, not kilobytes since that would be 2.3GB/day.

Whoops. Made it to the front page of HN with so many mistakes.

EDIT:

Since there seems to be interest in this let's do the test:

5 DNS requests + 1 NTP update according to the article (seems weird that it would resolve all the the NTP servers, but lets roll with it)

DNS: dig <domain> (mean for request is 43.8 B and reply is 84.6 B)

NTP: busybox_NTPD -n -q -p time.nist.gov

---------------------

Egress:

Single DNS request : 20 (IP) + 8 (UDP) + 44 (DNS) = 72 B

NTP request (2 packets): 20 (IP) + 8 (UDP) + 48 (NTP client) = 76 B

Total egress: 72x6 + 76x2 = 584 B

----------------------

Ingress:

Single DNS reply: 20 (IP) + 8 (UDP) + 85 (DNS) = 113 B

NTP reply (2 packets): 20 (IP) + 8 (UDP) + 48 (NTP server) = 76 B

Total Ingress: 113x6 + 76x2 = 830 B

----------------------

The total bandwidth used according to my calc is 1414 B. So their number of 138 KB is actually 1.38 KB (which is 1380 B, and that's closer to my number. I rounded up if you look at my numbers)

So their number of 715 MB is actually right. Just an error with 138 KB -> 1.38 KB

bravo22• 9 years ago

There are 86,400 seconds in a day. 138KB x 86400/5 = 238640KB /day = ~2328 MB/day = 69,840 MB/month = 67 GB/month.

I'm going to go on a limb and say his 138KB is more like 1.38KB which would bring us closer to his 0.71 GB/month

jlgaddis10• 9 years ago

Basically, every 5 seconds:

  (6 * (75 + 125)) + (90 + 90) == 1380

There's 86,400 seconds/day and an average of 276 bytes/second (1380/5), so per day this is:

  276 * 86400 == 23,846,400  -or-  1380 * (86400/5) == 23,846,400

Monthly:

  23,846,400 * 30 == 715,392,000

Or, "a total of 715,4 MB per month", as the article states.

cthalupa8• 9 years ago

Yet I don't think the author has a real takeaway: It's not 138KB.

Looking at DNS requests to those domains, I'm averaging about 30 bytes for the request and 70 bytes for the response.

Significantly larger and more complicated DNS requests returning a ton of DNSSEC records are coming around 4KB with eight separate UDP packets required for the response.

There is no way that 6 DNS queries for simple records and 1 NTP query comes in at 138 KB.

Edit: A dig on the 6 domains listed + a NTP query to one of them, for me, is sitting at less than 1KB total. Where are these numbers coming from?

Take a look at the response sizes in this CloudFlare post - https://blog.cloudflare.com/a-deep-dive-into-dns-packet-size... - they are talking about how they get DNSSEC responses under the 512 byte limit. The "unoptimized" ones are 4KB in response size. Even assuming that these domains turned on an unoptimized DNSSEC setup, that's still 24KB for those and less than 1KB for the NTP portion. The 138KB seems to be completely fabricated.

Edit2: Assuming the author meant 138 bytes as ktta pointed out, 86,400/5 = 17,280 sets of requests per day. That's 2,384,640 bytes, or ~2.3 megabytes a day. On a 31 day month, we're at ~71 megabytes. 1/10th of the amount the author is claiming.

Edit3: Though, 138 bytes seems low to me for 6 DNS queries and 1 NTP. Going by the numbers I get from a dig to the addresses it's closer to 600 bytes, which puts it at around ~309 megabytes per month. Without seeing what types of queries the repeaters are making it's hard for me to have any idea what the real numbers are, but it doesn't seem like the article's numbers add up regardless.

metafunctor• 9 years ago

Seems to me like 715 MB is about right, at least it's not off by a factor of 10.

There's no way you could fit six DNS queries and a couple of NTP queries into 138 bytes.

As pointed out by jlgaddis, based on the numbers in the article given for the size of DNS & NTP requests and responses, seems like the author meant 1380 bytes.

That gets you about 715 MB (or about 682 MiB).

void-star• 9 years ago

Strongly suspect this device doesn't have a RTC...

keypusher• 9 years ago

Somewhat unrelated but if you are looking for a rock-solid router, check out Microtik. I've been through half a dozen routers over the years, with and without custom firmware, and having owned a Mikrotik Routerboard for the last year, it's the first one that just works 100% and never drops connections. Easy to set up if you know what you are doing and customizable if you want to dig in.

Jaruzel3• 9 years ago

If you can't get a Mikrotik, then a Draytek is normally a good bet also.

garaetjjte• 9 years ago

Yeah, Mikrotik have great devices for reasonable prices, but it is irritating that you can't run own applications on it, there is no publicly available working kernel to run under MetaROUTER, and they want 45$ for GPLed sources

https://mikrotik.com/downloadterms.html

frankzinger2• 9 years ago

Check out http://demo.mt.lv/ and http://demo2.mt.lv/ for a live demo of the OS (RouterOS) that comes with Mikrotik products.

kuon• 9 years ago

I discovered PC engines APU boards and now I do all my routers/network thingie with it and OpenBSD. I'm quite sure there are some nice GUI "ala pfSense" too, but I like my configuration files better.

sschueller• 9 years ago

I purchased cheap crap TP-Link access points and replaced the firmware on each one with open-wrt[1] and they all works extremely well for many years now. The Stock firmware is total junk and crashes all the time.

[1] https://openwrt.org/

herpderperator• 9 years ago

Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex. If the SSID and security passphrases match, clients will roam seamlessly between the different APs. I suspect the reason people buy repeaters is that they don't realise that this is possible, or they don't want additional cabling.

Repeaters add latency and I can't imagine any network engineer would ever recommend one.

QasimK• 9 years ago

Well you’re normal WAP needs to be connected to the network itself somehow. A repeater does it wirelessly, while a normal WAP may not even have that option.

Jaruzel3• 9 years ago

Some OSs (I'm looking at you Windows) can get 'sticky' and refuse to fail over to the stronger AP even if it does have the same SSID and passphrase. The only solution is to force disconnect and reconnect the wifi on your device, and even then it doesn't fix it all the time.

I've found the most 'reliable' arrangement is to not only have the same SSID and passphrase, but to have them all on the same frequency and if you can, make them all from the same vendor.

Also, if you are going to re-purpose an old router as an access point, make sure you turn everything off on it except the access point service. It mustn't hand out IP addresses or offer any DNS resolution. You want your devices IP to be provided by the main router regardless of which AP you connect to. It sounds obvious, but this the main stumbling block people encounter when trying to do this.

lmns2• 9 years ago

Some Windows wifi drivers offer an option for roaming aggressiveness. I think I've seen this with some Intel cards.

mseebach• 9 years ago

I suspect [...] they don't want additional cabling.

You probably suspect correctly. Not having additional cabling is a pretty big selling point of wireless technology.

tatersolid2• 9 years ago

Especially as the majority of homes date back more than 25 years, and retrofitted cabling is very expensive.

And if you rent rather than own, you likely can’t add cabling at all under the terms of your lease.

slazaro• 9 years ago

Sometimes their simplicity wins out. I have a TP-Link repeater that just plugs into a wall socket and that's it, very quick setup. I just want it for a specific room that doesn't get wifi coverage; this was cheap and convenient, I'm happy with it.

I knew I could do it the proper way, but there would have been a lot of work involved, with very little payoff.

w0utert2• 9 years ago

> Don't bother with repeaters. Get normal access points, and install several of them if you need to disperse the range around a large area/building/complex.

Or better yet, buy a bunch of Ubiqity UniFi's, which were specifically made for this purpose and should provide the most seamless and efficient way to blanket your house in Wifi (provided you already have cabling to the access points). They are not cheap, but also not extremely expensive compared to a decent router either.

technofiend4• 9 years ago

Or better yet, buy a bunch of Ubiqity UniFi's

Warning: do not follow this advice; Ubuiqiti products are like potato chips in that you can never eat just one.

Oh I'll get the AC PRO access point, you think. Five minutes later you've set it via quick QR code scan and the UniFi app. That was painless! No wonder people recommend these things.

Oh wait I need to make some more device tweaks but UniFi won't do it.. better get the cloud key thingy that manages the device. I'll have one of those.

A couple of months go by and you discover your Google Home device or NEST doesn't work with beam steering. Wait, you can manage the advanced AC PRO settings using their own software? Fine I'll build a small PC to run that since if you're going to do it may as well see the stats all the time.

Hmm... KRACK/sploit-du-jour is out, maybe I'll just get a new Edgerouter since it's already fixed there. Oh wait, there's a fringy area in my house I'll bet another AC PRO or maybe an AirMax repeater would be just the thing.

Oh dear, I seem to be running out of ports, better go ahead and get a nice POE switch since that'll declutter things a bit. Etc.

pjc50• 9 years ago

UniFi devices are a bit unusual as wireless APs: not only do they not act as a DHCP server, they require you to have one somewhere else on the network. Generally your uplink router will do this, but it surprised me when I wanted to use one as a standalone AP.

rvanmil• 9 years ago

Or better yet, get the AmpliFi’s instead of the UniFi’s :)

shak77• 9 years ago

Most normal access points I've used won't work as wifi repeaters because they can't be in master and managed mode at the same time.

chatmasta2• 9 years ago

Does a router need two radios to support this dual mode? Or a single radio that supports transeiving? Or a single radio and two antennas? Or is a modified hostapd sufficient?

Basically, is it a hardware or software problem?

UncleEntity• 9 years ago

Don't bother with repeaters.

The restaurant I was 'stealing' wifi from (not to mention my landlord) probably would've had a problem with me running a hundred meters or so of ethernet cable so a $60 repeater + aluminium can parabolic dish and Bob's your uncle. Worked for around two years until the interference from my neighbors' wifi made to signal too dodgy and (I think) they got wise and changed the password.

zoe1337• 9 years ago

Powerline Ethernet might be a solution for the cable problem. I'm thinking of connecting the extra AP(s) through Powerline Ethernet to the router if there is no copper Ethernet available.

JustSomeNobody3• 9 years ago

Powerline Ethernet is not really a good solution either. If you don't use your phone jacks, take the cover off one and check if it's actually using Cat5 or greater. You can then use those for network if you replace the connectors.

discreditable• 9 years ago

This might be the wrong thread to recommend it, but I've had good luck with TP-Link's Powerline Ethernet adapters. I switched to them from WiFi for my living room TV/Gaming/Streaming setup. I'm in a high interference wireless environment due to neighbor density (even in 5Ghz) and the TP-Link devices reliably push over 500mbps.

A downside of powerline ethernet devices is they use your house wiring as a hub-style network. While I think some support a form of MIMO, the more devices you have the worse performance will be. The TP-Links I have sport QoS, but I've not messed with it.

lunchables3• 9 years ago

That's exactly what I did and it's worked out great. I'm getting upwards of 300Mb/s using powerline adapters. They were netgear brand, I apologize I don't remember the model, but I think it had "1200" in it. A lot will depend on what else you have on the breaker, from what I understand. But for my purposes the performance was more than adequate.

dnebdal• 9 years ago

In this specific case, the RE650 is sold as a repeater - but it also has an access point mode. If it wasn't for TP-Link's approach to software, it would be a nice enough AP: I get good speeds and coverage out of mine, and it's small enough that you can just plug it into a wall socket somewhere you can run a network cable to.

Oh well, I'll probably have to get an ubiqity or something.

slantyyz2• 9 years ago

> Repeaters add latency and I can't imagine any network engineer would ever recommend one.

Keep in mind that these TP-Links are consumer grade hardware, and that they make sense for some use cases. Not every consumer can or wants to run wire for another AP, regardless of what a network expert would say.

I use an RE450 at my dad's house (which happens to be next to mine) so when I'm there I can access the Internet. My parents don't have any computers, smartphones or tablets and don't use the Internet. The RE450 does the job -- very well I might add -- and was cheaper and easier than drilling holes in masonry to run a network wire between the houses.

The NTP and DNS requests are concerning, but they don't materially impact my bandwidth cap on the plan I'm on.

d2wa5• 9 years ago

Most TP-Link repeaters can act in Access Point mode. It uses the same firmware and has the same bugs no matter what mode it’s set to use.

easytiger• 9 years ago

To put this number in context: an always-on Windows device will use around 1,6 KB per month.

Windows doesn't do time sync properly so that's hardly a relevant comparison

Taniwha• 9 years ago

oh, f--k, every TP-link box on the planet is hitting nz.pool.ntp.org every 5 minutes? you guys know we only have a couple of cables connecting us to the rest of the world right?

Please don't buy TP-link, you're DoSing an entire country

chli• 9 years ago

5 times a second !

PhasmaFelis• 9 years ago

Once every 5 seconds.

Jaruzel3• 9 years ago

Slightly tangential, but I've recently been writing a command line tool to talk to some TP-Link Smart Plugs, and discovered that they regularly talk to 'devs.tplinkcloud.com' even if you don't enable a TP-link Cloud account.

More details here (not my site): https://www.softscheck.com/en/reverse-engineering-tp-link-hs...

Faaak• 9 years ago

I changed the server url on mines to "localhost". I control the plugs via a script on a docker container (they pilot water pumps). It works well that way.

unwind• 9 years ago

One silly thing that I hadn't thought of; the use of NTP for devices like this should mean that the NTP operators can gather pretty accurate statistics about each device's market share.

I guess the same folks who design software that spams things like this don't bother working too much on making it hard to fingerprint their devices, either. On the other hand, I haven't looked at the NTP protocol recently. Perhaps this isn't even possible due to the protocol's simplicity?

gcb02• 9 years ago

dns is a better target for this. Google even had rob pikes team do this sinkhole for them. which says its an expensive and worth goal and not some afterthought.

mikerg87• 9 years ago

Honest question. How would you begin discovering this kind of leakage? Do you need some sorry of tap that records protocols and Mac addresses? Do these firmware emplacements have this as a built in feature. With so many IOT devices being plugged in seems like this would be handy

pixl97• 9 years ago

Lots of enterprise equipment have features where you can mirror traffic off an ethernet port and monitor it, but it is cheap and easy to do if you are poor too. Dig up a 100MB hub, not a switch, and then with another computer plugged into that hub run a program like Wireshark or tcpdump.

This is one reason why I don't run all-in-one router/wireless combos. Most integrated (especially provided by ISP units) devices have no way to tell you what is being sent over the air and then to your ISP.

dboreham• 9 years ago

Use a decent router that allows packet sniffing. There are various low cost options. I use Mikrotik for example.

chatmasta2• 9 years ago

Easiest way is to plug the router into an upstream router that you control and sniff the traffic there.

d2wa5• 9 years ago

You get a good non-consumer grade router with network sniffing, per-device bandwidth and connection history, and other nice features like that.

phikai• 9 years ago

I noticed it based on Pi-Hole [0] and seeing the excessive DNS Requests to those URLs... started googling and found this post which I thought summed it all up nicely. Looking at the author's post, it also appears they noticed it due to Pi-Hole as well.

EDIT: It was a different post that someone had seen this via Pi-Hole. Not sure how the original author discovered it.

[0] https://pi-hole.net/

colanderman2• 9 years ago

an always-on Windows device will use around 1,6 KB per month

How is this possible? Is the author ignoring Windows Update?

djaychela• 9 years ago

I'm thinking he's just referring to the traffic relevant to the TP-Link firmware - otherwise there's no way to make any relevant comparison.

d2wa5• 9 years ago

In equivalent NTP traffic.

colanderman2• 9 years ago

Why all the downvotes? Sorry I asked a clarifying question, geez.

kees99• 9 years ago

  firmware sends six DNS requests and
  one NTP query every 5 seconds
  (...snip...)
  TP-Link has hardcoded the following non-configurable
  NTP servers and server pools in their firmware:
  (...snip...)
  au.pool.ntp.org, nz.pool.ntp.org

Wait... so TP-Link is effectively DDoSing NTP pool?

Also, as pointed out in another thread here, vendor using country prefix instead of applying for their own prefix is a violation of:

http://www.pool.ntp.org/en/vendors.html

..which was put in place as a reaction to incidents just like this one:

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#No...

zaarn• 9 years ago

A NTP request every couple seconds is similarly in violation of the vendor guidelines, once every 10 minutes or less often is stated.

nacs• 9 years ago

Would it be possible for the NTP server to detect what type of device/OS is sending the request and block it (ie: could au/nz.pool.ntp.org servers block all TP-Link requests to teach them a lesson)?

If they can't do that maybe they can just detect IPs that are making requests every 5 seconds as the TP-Link products are doing and block those since they're in violation of the once-every-10-minutes-maximum rule for the NTP servers)?

samstave• 9 years ago

Out-of-the-loop: what products are using TP-Link?

Aside: maybe there should be a governing body for comm protocol behavior? (Semi sarcastic)

mattstreet• 9 years ago

I'm a bit rusty, but I believe the way NTP works (at least the reference version which is commonly used) is that if a client sends too many requests in a short time, they are ignored except to reply with a "back off packet" which is called the KoD (Kiss of death) in NTP terms.

Security audits have found some issues with abusing the KoD so I'm not sure if it still works like that or if it tends to be disabled. (I was on one of the teams doing the audit, I found the "Skeleton Key" defect)

https://www.eecis.udel.edu/~mills/ntp/html/rate.html#kiss

If you wanted to help the server deal with DoS even better, I would guess the best solution is to put a rate limiting firewall in front of it.

hammock• 9 years ago

@dang why did you change the title to this (from the article's title)?

LordKano• 9 years ago

I know there's a joke to be made here.

"TP" link firmware is peeing in the pool of ntp servers...

I think I need more coffee first.

ausjke• 9 years ago

Just replace its firmware and load the router with LEDE/openwrt instead.

LEDE is an Openwrt fork, and it might merge back to Openwrt sometime.

LEDE is under active development and its newest release is 17.01.4 https://downloads.lede-project.org/releases/

NelsonMinar• 9 years ago

This kind of stupidity happens to NTP frequently. The ironic thing is NTP is so lightweight that sometimes it's better to just answer the query than try to block the traffic. The DNS traffic is more expensive than the time query!

Note this was reported on the NTP Pool Discourse about 3 weeks ago: https://community.ntppool.org/t/software-and-devices-without...

tom_usher• 9 years ago

I've been seeing an unusual amount of NTP requests in my PiHole logs but never got round to figuring out the cause - nice to have an explanation.

Hope this is fixed in a firmware update, my repeater is quite a nice device otherwise.

devy• 9 years ago

TP-Link is a major networking equipment manufacturer globally and one of the largest in China, just behind Huawei. They are one of the few who design equipment firmware/software and hardware in-house[1] and certainly have resource (man+money) to get the network protocol implementation right (sometime they don't) for their products and I wonder if the author has proactively reach out to them so that they can fix it for all (rather than public shaming and/or product ban)?

[1] https://en.wikipedia.org/wiki/TP-Link

wnevets• 9 years ago

slightly off topic, can anyone recommend a good router for home use? It seems like every major brand router is just awful.

gergles• 9 years ago

I find that my Synology router has been rock-solid and extremely performant. I have the RT2600ac and have been quite happy with it, and it has a nice web interface that you can configure automatic updates on, so it can even be distributed to people who aren't quite as network savvy.

frankzinger2• 9 years ago

As others have said, check out Mikrotik.

I recently bought https://mikrotik.com/product/RB952Ui-5ac2nD-TC. It was much cheaper than my previous stock Netgear router but it's orders of magnitude better.

This live demo of their web UI at http://demo.mt.lv/ and http://demo2.mt.lv/ should give you a good idea of what you get.

linsomniac2• 9 years ago

I ran a public NTP server for around a decade. I finally stopped, but these sorts of vendor abuse weren't the reason why.

We started running them before the NTP pool (though we eventually did include our servers in the pool). The worst it got was a largish regional ISP had put our servers in their CPE, and one day they had an event where they rebooted all of their CPE at once. That caused a noticeable spike in our network traffic.

The real DDoS that caused us to stop offering public DNS service was: misguided network admins. The week I had the second network admin calling me, asking why my network was attacking their network, and then started yelling at me over the phone and hung up in a huge huff. He had installed some sort of IDS and it was triggering on NTP traffic, and rather than investigate it he just called our emergency hotline and got me out of bed to deal with it.

"Those packets you are receiving are in response to packets you are sending our NTP server asking for the time." was not the answer he was looking for I guess. :-( Honestly, I was already mad from being woken up (the emergency hotline says it is for service outages only), and that it was the second call that week on it. So I take some blame in the call not going well. But this dude never stopped yelling at me.

The problem with running a public service is: The administration doesn't scale with the number of users.

Forbo• 9 years ago

NTP uses UDP, so he was probably the victim of a spoofed NTP request amplification attack. He probably didn't have clients that we're actually requesting the time, the requests were just spoofed to look like they came from his IP.

ktta8• 9 years ago

I'm leaning towards incompetence - Hanlon's razor and all that.

linsomniac2• 9 years ago

My recollection was that the volume coming from this one site was tiny, not like a DDoS. I don't recall if he said as much or if I was reading between the lines, but it sounded like he had just set up some sort of IDS, and it reported this traffic as an attack, and he just took that at face value.

We did have some UDP multiplication attacks at other times, mostly on our authoritative DNS servers. I don't recall that we ever had any against our NTP servers that I noticed. But we did block the broadcast address so the best multiplication vector was via DNS requests, IIRC the NTP responses were fairly short.

AgentME• 9 years ago

Didn't TP-Link backdoor one of their routers, additionally in a remotely-exploitable insecure way that they never patched?[0] Am I alone in that putting a company on my eternal shit-list? Looks like a good choice in retrospect if they're still coming up with things like this.

[0] https://tech.slashdot.org/story/13/03/15/1234217/backdoor-fo...

Sami_Lehtinen• 9 years ago

About every 5 seconds Ubuntu is making DNS lookup for: daisy.ubuntu.com.

d2wa5• 9 years ago

This issue has been fixed by a new firmware release from TP-Link. The updated firmware changes the behavior to use ICMP pings on the local network rather than NTP+DNS requests out on the public internet. https://www.ctrl.blog/entry/ntplink-fixed

TP-Link firmware sends six DNS requests and one NTP query every 5 seconds

Related Stories