NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

Bingoig11's avatar
Bingoig11
Star
Feb 10, 2021

NightHawk MK63 generating a lot of traffic

Hi there,   I've noticed in the logs of my firewall, that both MR60 and MS60 are generating a huge amount of traffic to netgear.com domain. This doesn't affect the bandwidth available as this is I...
Bingoig11's avatar
Bingoig11
Star
Apr 23, 2021
I've reopened a case to get feedback on a new firmware.
Unfortunately, still no ETA...
7.000.000 requests on my side, really noisy and annoying...
Mattse's avatar
Mattse
Guide
May 18, 2021

Hello netgear 

we are still wating for the firmware...

  • Bingoig11's avatar
    Bingoig11
    Star
    May 18, 2021
    I'm fed up waiting for this firmware...
    Thinking about replacing the Nighthawk with another not Netgear mesh system...
  • Mini4x's avatar
    Mini4x
    Guide
    May 31, 2021

    Same - this is unacceptable, phonein ghome 90,000 times every 24 hours isn't a small bug.

     

    Netgear support also closed my ticket and since my 30 days was up won't allow me to reopen or create a new case.

     

    Last time I buy anythign Netgear.

     

  • Bingoig11's avatar
    Bingoig11
    Star
    May 31, 2021

     

    DNS Queries only for ICMP...

    netgear seriously???

  • Mini4x's avatar
    Mini4x
    Guide
    May 31, 2021

    Mine is hitting

     

    www.netgear.com

    devicelocation.ngxcld.com

    time.nst.gov (set me time server to this for testing)

     

    Roughly 85,000 times a day, bith my MR60 and MS60 are doing this, i've tried going back a few veriosn of the firmware and still doing it.

     

     

  • Christian_R's avatar
    Christian_R
    NETGEAR Employee Retired
    Jun 04, 2021

    Hello Mini4x & Bingoig11, 

     

    May you send me a private message with your email address and case number(s) and I can look into this further. 


    Thanks,

    Christian 

  • Bingoig11's avatar
    Bingoig11
    Star
    Jun 21, 2021

    No news, no update, no new firmware...

    Think the mesh will be removed and replaced with another solution.

     

  • schumaku's avatar
    schumaku
    Guru - Experienced User
    Jun 24, 2021

    Christian_R appears the DNS resolver code in place does not do any caching, otherwise it would not query the DNS again for the default TTL, which is 86400 secs (1 day) for www.netgear.com [resp. default TTL = 900 (15 mins) for netgear.com SOA]. 

  • Mini4x's avatar
    Mini4x
    Guide
    Jun 24, 2021

    Th ebig question is why does it NEED to make 80,000 requests a day? I've blocked mine at this point, and am probably going with a Ubiquity setup instead this is just too much.

     

  • schumaku's avatar
    schumaku
    Guru - Experienced User
    Jun 24, 2021
    Mini4x wrote:

    Th ebig question is why does it NEED to make 80,000 requests a day?

    What ever the design intention is to do some Internet connection test every or every other second - this is what is _really_ going on there. But this implementation is multiplying the traffic .... DNS query .... ICMP .... both can't be right.

  • Mini4x's avatar
    Mini4x
    Guide
    Jun 24, 2021

    It's also hitting NTP every second.

     

    Clearly no need for this.

  • schumaku's avatar
    schumaku
    Guru - Experienced User
    Jun 25, 2021
    Mini4x wrote:

    It's also hitting NTP every second.

    Just again this **** DNS or real NTP trafic?

  • Mini4x's avatar
    Mini4x
    Guide
    Jun 25, 2021

    Not sure, it's in ym PiHole logs hitting 3-4 hosts 85.000 times a day.

     

    Tell me any valid reason this should do this?

  • Mattse's avatar
    Mattse
    Guide
    Jul 06, 2021
    Still no new firmware - Why?!?
  • Bingoig11's avatar
    Bingoig11
    Star
    Jul 06, 2021
    Just deployed the fix on router and satellites.
    Seems that constant requests are stopped but will monitor it tomorrow.
  • Chilli71's avatar
    Chilli71
    Aspirant
    Jul 06, 2021
    Christian_R
    What do you mean with DNS resolver code?
    That triggered my curiosity because when disabling 'get IP via DHCP' for the internet connection (with the latest hotfix version) the option get DNS from provider didn't work but always switch to static DNS.
    Would disabling 'get IP via DHCP' and static DNS be a work around?
    Or do you just mean normal DNS resolution requests? I couldn't imagine why they would be sent regularly.
    Update: I just read the latest post that it seems to be fixed.
    Maybe they just introduced a new bug with solving the previous one.

    Chilli
  • schumaku's avatar
    schumaku
    Guru - Experienced User
    Jul 06, 2021
    Chilli71 wrote:
    That triggered my curiosity because when disabling 'get IP via DHCP' for the internet connection (with the latest hotfix version) the option get DNS from provider didn't work but always switch to static DNS.

    The Intern/WAN Interface can either be configured by DHCP or statically (leaving the special PPP case away for simplicity - like DHCP, different protocol) for it's IP address, default gateway, subnet, DNS server(s).

     

    Only with DHCP, the option "get DNS from provider" does make sense. Without a DHCP client (read a static interface config), there is no way to magically get the DNS (we talk about one to three IP addresses where DNS services are available here) from the provider.

     

    Chilli71 wrote:
    Would disabling 'get IP via DHCP' and static DNS be a work around?

    Scratch this idea. The heavy DNS queries came from the satellites, and happen under any condition. The hotfix referred already is supposed to address this problem.

  • Bingoig11's avatar
    Bingoig11
    Star
    Jul 07, 2021

    After having a look on firewall logs, seems that I can confirm that issue is now resolved. ICMP requests have decreased dramatically.

    Still some of them but I assume this is a normal behaviour.

    Nevertheless, the time to get this fix is unacceptable...