380_4180 Wanduck probing frequency for dns.msftncsi.com

[thelonelycoder]

Since 380_4180 (and maybe earlier versions) Wanduck probes dns.msftncsi.com much more frequent.
I have not checked how often earlier versions do it but now I see dnsmasq log entries for the query at a rate of 10 to 30 times per minute.
This seems excessive to me. Is this a typo in the code (for the frequency) or is this intended?

If one were to disable the probing through nvram setting manipulation, what negative effects would be seen?

 

[sfx2000]

why is wanduck hitting microsoft's servers?

 

[thelonelycoder]

So many questions, no answers. Asus likely picked a common network connectivity server that is not maintained by themselves. To not raise questions why the routers probe an Asus Server frequently.

I turned that probing off on all my routers, with no negative effect so far. Not a single syslog entry that complains about.

 

[dsring]

https://www.snbforums.com/threads/constant-unwanted-traffic-to-dns-msftncsi-com-from-rt-ac66u.35367/

https://discourse.pi-hole.net/t/excessive-requests-for-dns-msftncsi-com/556

 

[thelonelycoder]

Thanks @dsring. But I already know this. Disabling the probing is built into the beta version of my Ad-blocker, if one so selects, properly and no reboot required.

I'm more interested in why the high frequency and what impact it really has on the WAN functions.
There are none so far on my four routers.

 

[dsring]

I disabled the probing a couple months ago and have had no connectivity issues.

 

[thelonelycoder]

I disabled the probing a couple months ago and have had no connectivity issues.

That's encouraging to hear, thanks for confirming the 'not confirmed to do anything' theory I have.

 

[hggomes]

From what I've understood that's to test for a working WAN connection on QiS, so if removed it will not work.

 

[bluepoint]

From what I've understood that's to test for a working WAN connection on QiS, so if removed it will not work.

What is QIS?

 

[sfx2000]

From what I've understood that's to test for a working WAN connection on QiS, so if removed it will not work.

Just turn it back to localhost - should always good a good return there

127.0.0.1 dns.msftncsi.com​

Done... or better yet... just push it to their akamai end point...

$ dig www.asus.com
; <<>> DiG 9.10.3-P4-Ubuntu <<>> www.asus.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10880
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:

;www.asus.com.            IN    A

;; ANSWER SECTION:
www.asus.com.        12163    IN    CNAME    www.asus.com.edgekey.net.
www.asus.com.edgekey.net. 933    IN    CNAME    e5110.e15.akamaiedge.net.
e5110.e15.akamaiedge.net. 19    IN    A    23.222.216.61

;; Query time: 56 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Sat Jan 28 16:19:19 PST 2017
;; MSG SIZE  rcvd: 130

 

[hggomes]

What is QIS?

Quick Install Setup

 

[thelonelycoder]

If the QIS is the only time Wanduck _really_ needs to probe then I wonder even more why it would need to do it every few seconds for the rest of the routers active live.
It's a bug, I'm almost sure it now.

 

[RMerlin]

I'd expect Dual WAN to alsy use it, unless they rely on a simple gateway ping.

 

[SomeWhereOverTheRainBow]

I'd expect Dual WAN to alsy use it, unless they rely on a simple gateway ping.

and here we are today....

@RMerlin I think you had a time machine or something!

 

[Tech9]

Dual WAN was available in 374 firmware for RT-N66U around 2012-2013, no?