NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Outbound traffic to Amazon space
Hello, I am wondering why my Orbi AC2200 unit (running latest firmware as of 2/23/2020, RBR20) is constantly making outbound connections to the Amazon space (52.0.0.0/11) over SSL/443. The home ...
Alas, my impression is that Netgear engineers are not assigned to monitor the dozens of community forums. Those of us who do are simply customers who are too cheap to pay for GearHead support (and who also find that members of the community often have more nuanced insight than the "GearHeads"). So, this is my initial impression
I had always thought that Netgear hosted Orbi firmware on "Netgear".
Here are the links I find in the Orbi parameters:
x_advisor_url=https://advisor.ngxcld.com/advisor/direct
x_claimed_url=https://registration.ngxcld.com/registration/status
x_discovery_url=https://presence.ngxcld.com/presence/presence
base_upgrade_url=https://http.fw.updates1.netgear.com/rbr50
fw_download_url=https://http.fw.updates1.netgear.com/rbr50/ww
genie_remote_url=https://genieremote.netgear.com/genie-remote/claimDevice
last_fw_upgrade_url=https://http.fw.updates1.netgear.com/rbr50/V2.3.5/ww
leafp2p_remote_url=http://peernetwork.netgear.com/peernetwork/services/LeafNetsWebServiceV2
leafp2p_replication_hook_url=https://readyshare.netgear.com/device/hook
leafp2p_replication_url=https://readyshare.netgear.com/device/entry
readycloud_fetch_url=https://readycloud.netgear.com/device/entry
readycloud_hook_url=https://readycloud.netgear.com/device/hook
readycloud_upload_url=https://readycloud.netgear.com/directio
Firmware updates seem to be hosted at Netgear.com.
None of these screams out "Amazon Cloud" directly, but the "ngxcld" appears to be in connection with Arlo cameras.
The Arin link seems to be pointing at "security":
WHOIS Source: ARIN
IP Address: 52.0.0.0
Country: usUSA - Washington
Network Name: AWS-SHELL-INTERNET
Owner Name: Shell Internet (Beijing) Security Technology Co. Ltd.
I also think it's weird that Orbi has all these links to readycloud when that feature is not implemented on the Orbi platform.
"Owner Name: Shell Internet (Beijing) Security Technology Co. Ltd." Gee wonder what kind of data mining here collecting. Scary. :smileyfrustrated:
CrimpOn wrote:Alas, my impression is that Netgear engineers are not assigned to monitor the dozens of community forums. Those of us who do are simply customers who are too cheap to pay for GearHead support (and who also find that members of the community often have more nuanced insight than the "GearHeads"). So, this is my initial impression
I had always thought that Netgear hosted Orbi firmware on "Netgear".
Here are the links I find in the Orbi parameters:
x_advisor_url=https://advisor.ngxcld.com/advisor/direct
x_claimed_url=https://registration.ngxcld.com/registration/status
x_discovery_url=https://presence.ngxcld.com/presence/presence
base_upgrade_url=https://http.fw.updates1.netgear.com/rbr50
fw_download_url=https://http.fw.updates1.netgear.com/rbr50/ww
genie_remote_url=https://genieremote.netgear.com/genie-remote/claimDevice
last_fw_upgrade_url=https://http.fw.updates1.netgear.com/rbr50/V2.3.5/ww
leafp2p_remote_url=http://peernetwork.netgear.com/peernetwork/services/LeafNetsWebServiceV2
leafp2p_replication_hook_url=https://readyshare.netgear.com/device/hook
leafp2p_replication_url=https://readyshare.netgear.com/device/entry
readycloud_fetch_url=https://readycloud.netgear.com/device/entry
readycloud_hook_url=https://readycloud.netgear.com/device/hook
readycloud_upload_url=https://readycloud.netgear.com/directio
Firmware updates seem to be hosted at Netgear.com.
None of these screams out "Amazon Cloud" directly, but the "ngxcld" appears to be in connection with Arlo cameras.
The Arin link seems to be pointing at "security":
WHOIS Source: ARIN
IP Address: 52.0.0.0
Country: usUSA - Washington
Network Name: AWS-SHELL-INTERNET
Owner Name: Shell Internet (Beijing) Security Technology Co. Ltd.I also think it's weird that Orbi has all these links to readycloud when that feature is not implemented on the Orbi platform.
FURRYe38 wrote:"Owner Name: Shell Internet (Beijing) Security Technology Co. Ltd." Gee wonder what kind of data mining here collecting. Scary. :smileyfrustrated:
It's part of Amazon Web Services (the "AWS" part at the front). This is a useful discussion for me. I had assumed that once in Access Point mode, the Orbi reverted to a dumb WiFi AP. Now that I have the occasion to reflect, it is pretty obvious that the Orbi is still going to to "maintenance things" that are not "routing", such as looking for firmware updates, managing Arlo cameras, supporting ReadyShare (Ha!), sending log files(?).
It would be interesting to look at the DNS requests that led to the Orbi wanting to connect to 52.0.0.0.
CrimpOn, thanks for the useful info. I am going to build separate firewall policies for the FQDN objects that use https:// URLs to give me more fw logs and what protocols they are using. I am still not 100% sure what that ssl/8883 is doing?
I will run a sniffer to catch DNS queries to confirm the links you posted (+ additional hidden ones). I am not a big fan of devices that do a very chatty 'outside' life.
For now, I am dropping all outbound traffic from the Orbi (in AP mode).
I wonder if this is something that Voxel might be able to tune up or tune out. I know he's removed some packages from the base file and set them aside for use later of if users want them. Something to ask him about and see. Though this maybe core code which he can't change. :smileyindifferent:
I know NG and other Mfrs are using Amazon as a platform for there cloud services these days. Been like this for a while now.
Ya I kinda presumed that when in AP mode that analytics would be turned off. I guess not. :smileyfrustrated:
CrimpOn wrote:
FURRYe38 wrote:"Owner Name: Shell Internet (Beijing) Security Technology Co. Ltd." Gee wonder what kind of data mining here collecting. Scary. :smileyfrustrated:
It's part of Amazon Web Services (the "AWS" part at the front). This is a useful discussion for me. I had assumed that once in Access Point mode, the Orbi reverted to a dumb WiFi AP. Now that I have the occasion to reflect, it is pretty obvious that the Orbi is still going to to "maintenance things" that are not "routing", such as looking for firmware updates, managing Arlo cameras, supporting ReadyShare (Ha!), sending log files(?).
It would be interesting to look at the DNS requests that led to the Orbi wanting to connect to 52.0.0.0.
>>>>>>>>>>>>>>>>
After capturing DNS traffic, the Orbi unit is making constant lookups of advisor.ngxcld.com which is:
CNAME advisor-z2-ngprod-1997768525.us-west-2.elb.amazonaws.com (at the time of the pcap):
advisor-z2-ngprod-1997768525.us-west-2.elb.amazonaws. com. 60 IN A 52.24.192.26
advisor-z2-ngprod-1997768525.us-west-2.elb.amazonaws. com. 60 IN A 52.24.160.87
In addition, I saw a DNS queries for www.netgear.com (once an hour).
It appears the frequent traffic is going to a web analytics platform, Ngxcld.com (Website Analysis and Traffic Statistics).
There are some posts on reddit and arlo forums indicating the same outbound pattern.>>>>>>>>>>>>>>>>