Solved: DNS Requests to baidu.com from Unleashed AP.

Anonymous · ‎05-21-2019

I had an internet outage at my home yesterday. After taking a look at my PiHole I noticed that my Unleashed R310 had made 1200 DNS requests to that domain in the course of a few hours.

After some searching I've never seen a baidu.com DNS lookup from the AP. Is this an undocumented thing? Just want to make sure that I don't have a compromised firmware or anything.

sanjay_kumar · ‎04-08-2023

Hi,

Updating the below info with solution:

By design the APs will use the below sites to check the internet status.
captive.apple.com
www.microsoft.com
www.baidu.com
We have introduced the option to disable the Internet check. With this option, we can disable the internet check completely or disable particular site. This can be done from the CLI

ruckus> en
ruckus# config
You have all rights in this mode.
ruckus(config)# system

ruckus(config-sys)# show internet-check
Internet Check:
Company = apple, Enable = 1

Internet Check:
Company = microsoft, Enable = 1

Internet Check:
Company = ruckus, Enable = 1

Now to disable this use the below command:

ruckus(config-sys)# no internet-check all
The internet check settings have been updated.
ruckus(config-sys)# end
Your changes have been saved.

To cross check:
ruckus(config)# system
ruckus(config-sys)# show internet-check
Internet Check:
Company = apple, Enable = 0

Internet Check:
Company = microsoft, Enable = 0

Internet Check:
Company = ruckus, Enable = 0

I would recommend using this function in 200.14, which will be available from April 2nd week 2023

View solution in original post

michael_brado · ‎05-21-2019

I don't think anything in our firmware has any DNS contact code. Try collecting a wired trace and see if you can determine the source MAC client.

michael_brado · ‎05-22-2019

I stand corrected - our APs _do_ look for Internet connectivity. All APs will look to our cloud based AP Registrar (APR) to see if they belong on a Cloud controller, otherwise look locally for a nearby ZoneDirector, SmartZone or Unleashed network, and if not finding any of these and running our Solo/Standalone firmware image, they would present a Solo/Standalone WebUI.
I'm researching other Internet targets that might be used to detect Internet connectivity, ie www.microsoft.com, and captive.apple.com I've heard before.

mike_kuly · ‎05-22-2019

Patrick,

I was curious about your question yesterday so I did a little digging. This is what I found...
Our controllers will ping the following sites to ensure we have internet connectivity.
apple.com, Microsoft.com, Baidu.com and support.ruckuckuswireless.com.
We will do this every 3 seconds if we determine there is no internet service. If we do detect the internet is available we change that polling to every 60 seconds.

So it looks like the AP was doing what it was designed to do. Hopefully you can breath a little easier now.

michael_brado · ‎05-22-2019

Thanks Mike,
And it appears we have a FR-3731 to either configure the Internet targets, or turn off detection on Unleashed APs. Customers who open a ticket can request a link to FR-3731 to add votes.