Diversion Diversion &/or Skynet blocking LG TV's access to LG servers?

[brec]

I have reason for suspicion but I haven't confirmed this issue, nor have I pinned it down to either Diversion or Skynet, but it would help me to do one or both if anyone has experienced the subject issue. A long shot, I know.

 

[dave14305]

Both tools will log what they block if you have logging enabled.

 

[brec]

Logging is on in both, but I'm not sure what I'm looking for; I have no IP addresses of the target servers -- only certain functions not "loading" on the TV. I'm ignorantly guessing that what's blocked is outbound from the TV.

As an end run, if there's a way to exempt requests from or replies to a specified local IP address, I could manually assign the TV's address. Currently it's DHCP-assigned.

 

[zackattack784]

I had this issue awhile back. I believe it was diversion. I just whitelisted my tv and haven’t had an issue since.

 

[brec]

Thanks for the clue! I can see how to whitelist WAN domains, but not how to whitelist a local device.

Edit: it's SkyNet, not Diversion.

 

[brec]

Whoops! Turns out it's SkyNet that's causing the issue. Now to see if I can whitelist a local device in SkyNet....

 

[brec]

And now I'm not sure it's either of them. Some kind of timing/caching is making it hard to isolate the problem.

Henceforth I'll try to avoid turning this thread into a blog

 

[dave14305]

And now I'm not sure it's either of them. Some kind of timing/caching is making it hard to isolate the problem.

Henceforth I'll try to avoid turning this thread into a blog

Logs from both tools that show the TV local IP should narrow it down, especially if it’s Skynet.

 

[brec]

It's Diversion. Here are some contiguous log entries; the TV is 192.168.50.8; there is one "blocked" entry in the 7th line, where it's reported "is 192.168.50.2," which is the pixelserv-tls IP; I don't know what's going on with the blocked domain in the 8th-10th lines:

Oct 20 05:39:48 dnsmasq[12524]: query[A] us.lgrecommends.lgappstv.com from 192.168.50.8
Oct 20 05:39:48 dnsmasq[12524]: forwarded us.lgrecommends.lgappstv.com to 1.1.1.2
Oct 20 05:39:49 dnsmasq[12524]: reply us.lgrecommends.lgappstv.com is <CNAME>
Oct 20 05:39:49 dnsmasq[12524]: reply us-lgrecommends-lgappstv-com.aws-prd.net is 52.12.52.75
Oct 20 05:39:49 dnsmasq[12524]: reply us-lgrecommends-lgappstv-com.aws-prd.net is 44.238.228.41
Oct 20 05:39:50 dnsmasq[12524]: query[A] US.lgtvsdp.com from 192.168.50.8
Oct 20 05:39:50 dnsmasq[12524]: blocked by blockinglist US.lgtvsdp.com is 192.168.50.2
Oct 20 05:39:50 dnsmasq[12524]: query[AAAA] US.lgtvsdp.com from 192.168.50.8
Oct 20 05:39:50 dnsmasq[12524]: forwarded US.lgtvsdp.com to 1.1.1.2
Oct 20 05:39:50 dnsmasq[12524]: reply US.lgtvsdp.com is <CNAME>
Oct 20 05:39:51 dnsmasq[12524]: query[A] us.tvsdp.lgeapi.com from 192.168.50.8
Oct 20 05:39:51 dnsmasq[12524]: forwarded us.tvsdp.lgeapi.com to 1.1.1.2
Oct 20 05:39:51 dnsmasq[12524]: reply us.tvsdp.lgeapi.com is <CNAME>
Oct 20 05:39:51 dnsmasq[12524]: reply aicip.tvsdp.lgeapi.com is <CNAME>
Oct 20 05:39:51 dnsmasq[12524]: reply aicip-tvsdp-lgeapi-com.aws-prd.net is 35.164.252.43

Here are some later ones filtered on the TV's IP:

05:52:14 dnsmasq[12524]: query[A] us.lgrecommends.lgappstv.com from 192.168.50.8
05:52:15 dnsmasq[12524]: query[A] US.lgtvsdp.com from 192.168.50.8
05:52:15 dnsmasq[12524]: query[AAAA] US.lgtvsdp.com from 192.168.50.8
05:52:16 dnsmasq[12524]: query[A] us.tvsdp.lgeapi.com from 192.168.50.8
05:52:51 dnsmasq[12524]: query[A] discovery.meethue.com from 192.168.50.8
05:52:51 dnsmasq[12524]: query[AAAA] discovery.meethue.com from 192.168.50.8

Since the only domain actually reported blocked is US.lgtvsdp.com, I thought I'd whitelist it, but:

 Enter domain  [e=Exit] US.lgtvsdp.com
____________________________________________________

 US.lgtvsdp.com
 was not found in blocking list(s), looking for
 near match(es):

 none found in blocking list Standard
 none found in secondary blocking list 
____________________________________________________

 US.lgtvsdp.com
 was not found in blocking list(s)

 If you add it anyway, it may have no effect unless
 you select a larger blocking list.

 The domain will be marked #(forced-entry) and is
 not re-added to the blocking list if you remove it.

 Add it to whitelist anyway? [1=Yes 2=No]

 

[dave14305]

It's Diversion. Here are some contiguous log entries; the TV is 192.168.50.8; there is one "blocked" entry in the 7th line, where it's reported "is 192.168.50.2," which is the pixelserv-tls IP; I don't know what's going on with the blocked domain in the 8th-10th lines:

Oct 20 05:39:48 dnsmasq[12524]: query[A] us.lgrecommends.lgappstv.com from 192.168.50.8
Oct 20 05:39:48 dnsmasq[12524]: forwarded us.lgrecommends.lgappstv.com to 1.1.1.2
Oct 20 05:39:49 dnsmasq[12524]: reply us.lgrecommends.lgappstv.com is <CNAME>
Oct 20 05:39:49 dnsmasq[12524]: reply us-lgrecommends-lgappstv-com.aws-prd.net is 52.12.52.75
Oct 20 05:39:49 dnsmasq[12524]: reply us-lgrecommends-lgappstv-com.aws-prd.net is 44.238.228.41
Oct 20 05:39:50 dnsmasq[12524]: query[A] US.lgtvsdp.com from 192.168.50.8
Oct 20 05:39:50 dnsmasq[12524]: blocked by blockinglist US.lgtvsdp.com is 192.168.50.2
Oct 20 05:39:50 dnsmasq[12524]: query[AAAA] US.lgtvsdp.com from 192.168.50.8
Oct 20 05:39:50 dnsmasq[12524]: forwarded US.lgtvsdp.com to 1.1.1.2
Oct 20 05:39:50 dnsmasq[12524]: reply US.lgtvsdp.com is <CNAME>
Oct 20 05:39:51 dnsmasq[12524]: query[A] us.tvsdp.lgeapi.com from 192.168.50.8
Oct 20 05:39:51 dnsmasq[12524]: forwarded us.tvsdp.lgeapi.com to 1.1.1.2
Oct 20 05:39:51 dnsmasq[12524]: reply us.tvsdp.lgeapi.com is <CNAME>
Oct 20 05:39:51 dnsmasq[12524]: reply aicip.tvsdp.lgeapi.com is <CNAME>
Oct 20 05:39:51 dnsmasq[12524]: reply aicip-tvsdp-lgeapi-com.aws-prd.net is 35.164.252.43

Here are some later ones filtered on the TV's IP:

05:52:14 dnsmasq[12524]: query[A] us.lgrecommends.lgappstv.com from 192.168.50.8
05:52:15 dnsmasq[12524]: query[A] US.lgtvsdp.com from 192.168.50.8
05:52:15 dnsmasq[12524]: query[AAAA] US.lgtvsdp.com from 192.168.50.8
05:52:16 dnsmasq[12524]: query[A] us.tvsdp.lgeapi.com from 192.168.50.8
05:52:51 dnsmasq[12524]: query[A] discovery.meethue.com from 192.168.50.8
05:52:51 dnsmasq[12524]: query[AAAA] discovery.meethue.com from 192.168.50.8

Since the only domain actually reported blocked is US.lgtvsdp.com, I thought I'd whitelist it, but:

Enter domain  [e=Exit] US.lgtvsdp.com
____________________________________________________

US.lgtvsdp.com
was not found in blocking list(s), looking for
near match(es):

none found in blocking list Standard
none found in secondary blocking list
____________________________________________________

US.lgtvsdp.com
was not found in blocking list(s)

If you add it anyway, it may have no effect unless
you select a larger blocking list.

The domain will be marked #(forced-entry) and is
not re-added to the blocking list if you remove it.

Add it to whitelist anyway? [1=Yes 2=No]

Try entering it in all lowercase.

 

[dave14305]

I don't know what's going on with the blocked domain in the 8th-10th lines:

It’s making a query for the IPv6 address (type AAAA), which I assume isn’t enabled on your router.

 

[brec]

Try entering it in all lowercase.

That worked to whitelist it, which worked to solve one of the TV issues. There's another, more minor, issue which I'll keep trying to isolate.