AI mesh and Pihole DNS spam: what I found out and where I’m stuck

[vmachiel]

Hi,

So I’ve done some digging to the best of my abilities, but I can’t fix the problem so here I am.

Ever since I hooked up my new router (RT-BE86U running the latest merlin) my previous one (RT-AX86U running the latest merlin) has been placed upstairs as a wired backhaul AI mesh. My router is set up to direct all DNS traffic to my two raspberry pi’s running pihole+unbound. I have it setup in the LAN-> DHCP settings.

Ever since the old router became a mesh node I see the dns.msftncsi.com domain being request to my pihole every minute. Searching led me to this very forum, and it seems to be a check if the internet connection is there. (Why the MS domain for that though…). My router without AImesh never did this, and the local IP that is requesting it IS the AImesh router so that has be the issue.

I want this not to happen, but again this forum test me to go to Administration -> System, and check under network monitoring. It can use dns for that. But it’s turned off on my main router. Makes sense: I don’t see the queries coming from there. If I check the box, I see the dns.msftncsi.com domain as a default so my conclusion is:

The AI mesh router DOES have the checkbox checked, and thus it’s sending out those DNS requests constantly. But again this forum (so much good info here) tells me I can’t login to the AImesh node separately. Which is true: i get redirected if I enter the local IP of the AImesh node.

So is there any way to get into those settings and turn off that DNS check? I don’t care if the ‘internet is up’ function doesn’t work anymore, I just want that DNS spam gone.

Thanks in advance for any help. (Hopefully the English is ok, not a native speaker).

 

[bbunge]

Put the AX86U back on Asus firmware. I did not see those requests when I was running a Pi-Hole as a test a week ago.

 

[Tech9]

My router without AImesh never did this, and the local IP that is requesting it IS the AImesh router so that has be the issue.

This is what most likely happened - your router uses WAN DNS servers for own needs, it was still querying Microsoft connectivity check even when DNS check is disabled in firmware, but it was not registered to your Pi-holes. Now your AiMesh node is a client on the network and you see the queries. To me - there is no real problem and nothing to solve. Just the way connectivity check works on Asus routers.

 

[vmachiel]

So the disabling the DNS check does nothing? Maybe I’ll ask about this in the Merlin forums.

 

[Tech9]

I don't think it's Asuswrt-Merlin related. Last time I played with an Asus router on stock 388 firmware with Network Monitoring disabled in Administration/System it was still making multiple queries to the Microsoft connectivity check server. Most likely it's used internally by other firmware components and you better don't mess with it. Nothing wrong with it and no privacy issue, in case this is your concern.

 

[Tech9]

You can try redirecting the node IP to your router's LAN IP for DNS queries. This will stop the log spam on your Pi-hole.

 

[vmachiel]

Ok thanks, I’ll try that and otherwise I’m just going to have to live with it

 

[bennor]

.... the dns.msftncsi.com domain

An older thread discussing msftncsi requests.

Network flooded by dns.msftncsi.com requests

Hi! Every 15 seconds the router sends a request to dns.msftncsi.com and is flooding the network. I found a setting in the router GUI. Ticking "DNS query" makes it visible, it doesn't affect the frequency of the request tho: What is the purpose of these requests and how can I decrease the...

www.snbforums.com

More on Microsoft Network Connection Status Indicator (NCSI).

Network Connection Status Indicator (NCSI) troubleshooting guidance - Windows Server

Provides guidance to help troubleshoot NCSI issues.

learn.microsoft.com