NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Outbound traffic to Amazon space
Hello, I am wondering why my Orbi AC2200 unit (running latest firmware as of 2/23/2020, RBR20) is constantly making outbound connections to the Amazon space (52.0.0.0/11) over SSL/443. The home ...
FURRYe38 wrote:"Owner Name: Shell Internet (Beijing) Security Technology Co. Ltd." Gee wonder what kind of data mining here collecting. Scary. :smileyfrustrated:
It's part of Amazon Web Services (the "AWS" part at the front). This is a useful discussion for me. I had assumed that once in Access Point mode, the Orbi reverted to a dumb WiFi AP. Now that I have the occasion to reflect, it is pretty obvious that the Orbi is still going to to "maintenance things" that are not "routing", such as looking for firmware updates, managing Arlo cameras, supporting ReadyShare (Ha!), sending log files(?).
It would be interesting to look at the DNS requests that led to the Orbi wanting to connect to 52.0.0.0.
CrimpOn, thanks for the useful info. I am going to build separate firewall policies for the FQDN objects that use https:// URLs to give me more fw logs and what protocols they are using. I am still not 100% sure what that ssl/8883 is doing?
I will run a sniffer to catch DNS queries to confirm the links you posted (+ additional hidden ones). I am not a big fan of devices that do a very chatty 'outside' life.
For now, I am dropping all outbound traffic from the Orbi (in AP mode).