Diversion Diversion - the Router Ad-Blocker

[L&LD]

For fun, I just disabled Diversion on my 86u running 384.11. Adaptive QOS & AI Protection are still enabled. Only other script is JR Fresh QOS settings.
It's been and hour and no dcd crashes. I'll keep testing.

EDIT -- I see that TLC chimed in while I was typing this.

You may be better off disabling AiProtection instead.

https://www.snbforums.com/threads/trend-micro-hacked-by-fxmsp.56578/

 

[Butterfly Bones]

You may be better off disabling AiProtection instead.

https://www.snbforums.com/threads/trend-micro-hacked-by-fxmsp.56578/

Best solution is keep all protective functions / scripts enabled and use the remove dcd crash script from cmkelley or better yet, use the scribe (syslog-ng and logrotate installer) script from cmkelley. Both will keep your logs clean and you can patiently wait for TrendMicro to fix their bug. There is an added benefit to stop driving RMerlin crazy. (insert thumbups emoji)

 

[Delusion]

Best solution is keep all protective functions / scripts enabled and use the remove dcd crash script from cmkelley or better yet, use the scribe (syslog-ng and logrotate installer) script from cmkelley. Both will keep your logs clean and you can patiently wait for TrendMicro to fix their bug. There is an added benefit to stop driving RMerlin crazy. (insert thumbups emoji)

How do I remove the dcd ugly crash from the log using "scribe" ?

 

[Butterfly Bones]

How do I remove the dcd ugly crash from the log using "scribe" ?

There is a "crash" filter file included as a default. Read the first few posts of that thread. You can filter the entire webgui syslog to individual logs, based on your wishes / needs. There are posts there about other filter files that some of us have created. Best to move this conversation to that thread, it is OT here, even though I know I started it. There is an easier solution with remove dcd script that I posted above too. Scribe has a bit of a steep learning curve, but well worth it if you run many scripts and want to clean up the messy webgui). I have two scripts that run every 30 seconds, you can see how that gets messy.

end OT

 

[cmkelley]

How do I remove the dcd ugly crash from the log using "scribe" ?

I also created a Gist at: https://gist.github.com/cynicastic/96440e6de6e326fcee84c94a5e45cdac that sets up a cron job to scrub the syslog.log every 10 minutes. You should already have a post-mount script in /jffs/scripts, if you do, you can copy everything but the first line with the shebang ("#! /bin/sh") to your post-mount script and it will take care of that for you, and also symlink /opt/root to /tmp/home/root so you don't lose the contents of your root directory on reboot.

 

[tardis]

is this command still good for blocking dns.msftncsi.com, "nvram set dns_probe=0;nvram set dns_probe_content=;nvram commit" ?
latest merlin 384.11 with Diversion, Skynet, Entware, pixelserv-tls and uiDivStats

 

[thelonelycoder]

is this command still good for blocking dns.msftncsi.com, "nvram set dns_probe=0;nvram set dns_probe_content=;nvram commit" ?
latest merlin 384.11 with Diversion, Skynet, Entware, pixelserv-tls and uiDivStats

Sure is. The probing still happens in 384.11 despite it being turned off in the WebUI.
To permanently disable the probing enter this into the terminal, probing will stop immediately:

nvram set dns_probe=0;nvram set dns_probe_content=;nvram commit

To restore it, enter this:

nvram set dns_probe=0;nvram set dns_probe_content='131.107.255.255 112.4.20.71 fd3e:4f5a:5b81::1';nvram commit

 

[Ro berto]

is this command still good for blocking dns.msftncsi.com, "nvram set dns_probe=0;nvram set dns_probe_content=;nvram commit" ?
latest merlin 384.11 with Diversion, Skynet, Entware, pixelserv-tls and uiDivStats

yes, but it will disable the dual wan feature (not that anybody has ever used it though)

 

[Butterfly Bones]

yes, but it will disable the dual wan feature (not that anybody has ever used it though)

Except @skeal the adventurous explorer, going where others fear to tread.

 

[Jumpstarter]

so here is my predicament
* I try to white list ads, they get blocked...
* I try to disable diversion, ads get blocked...
* I try to uninstall diversion *FAILS* ads still get blocked...

Diversion works too good
what can i do?

 

[Jumpstarter]

Sure is. The probing still happens in 384.11 despite it being turned off in the WebUI.
To permanently disable the probing enter this into the terminal, probing will stop immediately:

nvram set dns_probe=0;nvram set dns_probe_content=;nvram commit

To restore it, enter this:

nvram set dns_probe=0;nvram set dns_probe_content='131.107.255.255 112.4.20.71 fd3e:4f5a:5b81::1';nvram commit

what is the benefit of doing this?

 

[Jumpstarter]

so here is my predicament
* I try to white list ads, they get blocked...
* I try to disable diversion, ads get blocked...
* I try to uninstall diversion *FAILS* ads still get blocked...

Diversion works too good
what can i do?

this time i unplugged the flash drive ads still being blocked.

 

[EmeraldDeer]

what is the benefit of doing this?

Stop frequent, useless DNS traffic

 

[jsbeddow]

Yes, but what purpose does this particular DNS probe attempt to accomplish? Is that Microsoft's way for Windows machings to know if internet access is functioning correctly? Or, are these probes coming directly from our Asus routers?

Stop frequent, useless DNS traffic

 

[Ro berto]

Yes, but what purpose does this particular DNS probe attempt to accomplish? Is that Microsoft's way for Windows machings to know if internet access is functioning correctly?

actually it's not related to Windows machines, it's originated in the router itself, I think it's to check when the internet is down so you could change to the other wan in case you're using the dual wan feature (I think it's a bug because even though you uncheck the checkbox DNS queries on Network Monitoring under System in Administration it will still send those unwanted (at least for me) DNS traffic queries.)

 

[thelonelycoder]

Yes, but what purpose does this particular DNS probe attempt to accomplish? Is that Microsoft's way for Windows machings to know if internet access is functioning correctly? Or, are these probes coming directly from our Asus routers?

That's the router checking if the WAN interface is up and connected to the internet. dns.msftncsi.com is just a (reliable) host to ping.
Billions of devices use this or other hosts to determine if the device is connected to the internet.

Diversion uses (in that order) Level 3 (209.244.0.3), Cloudfare (1.1.1.1) or Google (8.8.8.8) to check before installing.

 

[thelonelycoder]

this time i unplugged the flash drive ads still being blocked.

Pulling out the USB device without ejecting it first does not necessarily disable ad-blocking, Dnsmasq may still have the blocking list in cache.
Reboot the router without the device and see if things still get blocked.

 

[thelonelycoder]

so here is my predicament
* I try to white list ads, they get blocked...
* I try to disable diversion, ads get blocked...
* I try to uninstall diversion *FAILS* ads still get blocked...

Diversion works too good
what can i do?

You may have another ad-blocker somewhere installed/activated doing what ad-blockers do.

 

[Jumpstarter]

okay i do not know what to do now... I have rebooted after unplugging flash drive. made sure i have no browsers with built in ad-blocking enabled. my internet is still running with ads being blocked what else can i try?

 

[Asad Ali]

okay i do not know what to do now... I have rebooted after unplugging flash drive. made sure i have no browsers with built in ad-blocking enabled. my internet is still running with ads being blocked what else can i try?

What DNS servers you're using?
Some ad blocking DNS servers do the same kind of job what Diversion does.