Hello. R610 AP on Unleashed 200.13.6.1.319.
TLDR: Unleashed doing DNS lookups and outbound HTTP to Apple (and others), part of Internet Checking functionality, can be disabled in limited fashion, but prefer to completely disable.
Logging devices in same environment have been recording excessive DNS lookups and outbound HTTP to captive.apple.com from the AP. After some topic searching here and elsewhere it appears to be a function of the Internet Connectivity checking with Unleashed. I see outbound traffic every 65 seconds initially caught in Suricata IDS logs (outbound HTTP, curl User-Agent), but also seen in Unbound DNS logs.
Using the Internet-check CLI command via SSH I managed to disable the checks. The functionality appears to contact captive.apple.com, but falls back to www.microsoft.com and then support.ruckuswireless.com if unable to reach first. All three were disabled, but now every 35 seconds I'm seeing DNS lookups to www.apple.com , along with IPv4 and IPv6 Reverse DNS lookups for same domain. Obviously the prior attempt to disable the Internet Checking is limited and actually creates more log spam than before.
Are there possibly any undocumented CLI commands to disable the remaining attempts?
While this is not a large issue by any means, I prefer to not have the AP reach out if not necessary and create log spam. For the time being, I left support.ruckwireless.com check enabled reducing lookups to 65 seconds and have a host override in Unbound to blackhole the request. Still creates some log spam which can't be filtered, though I can purge ever so often when needed. Thanks.
CLI command reference:
https://docs.commscope.com/en-US/bundle/unleashed-200.13-commandref/page/GUID-B6343A24-59CA-4711-815E-F33ED87E8A46.html
Previous mention of issue within this forum:
https://community.ruckuswireless.com/t5/Access-Points-Indoor-and-Outdoor/DNS-Requests-to-baidu-com-from-Unleashed-AP/m-p/39502/page/1
