Sorry, this has got very long now.
Colin Taylor I looked through wanduck.c and it seems to me that your suggestion regarding Network Monitoring may be a good idea. I have set:
View attachment 35637
The wanduck.c code is very hard to follow but I think this gets called with the functions do_dns_detect() and do_ping_detect().
When you set the network monitoring then dns_probe gets set to '1':
Code:
admin@RT-AX86U-4168:/tmp/home/root# nvram show |grep -i dns_probe
dns_probe=1
dns_probe_content=131.107.255.255 112.4.20.71 fd3e:4f5a:5b81::1
dns_probe_host=dns.msftncsi.com
size: 71879 bytes (59193 left)
And also wandog_target (for ping probe) gets set:
Code:
admin@RT-AX86U-4168:/tmp/home/root# nvram show |grep -i wandog
wandog_delay=0
wandog_enable=1
wandog_fb_count=4
wandog_interval=5
wandog_maxfail=12
wandog_target=www.google.com
size: 71879 bytes (59193 left)
And it seems to be actually doing something every 5 seconds (presumably given wandog_interval=5):
Code:
admin@RT-AX86U-4168:/tmp/home/root# tcpdump -vpni tun11 |grep -i msftncsi.com
tcpdump: listening on tun11, link-type RAW (Raw IP), capture size 262144 bytes
10.8.3.2.43853 > 185.228.168.168.53: 24973+ A? dns.msftncsi.com. (34)
185.228.168.168.53 > 10.8.3.2.43853: 24973 1/0/0 dns.msftncsi.com. A 131.107.255.255 (50)
10.8.3.2.51202 > 185.228.168.168.53: 46556+ A? dns.msftncsi.com. (34)
185.228.168.168.53 > 10.8.3.2.51202: 46556 1/0/0 dns.msftncsi.com. A 131.107.255.255 (50)
10.8.3.2.36507 > 185.228.168.168.53: 55641+ A? dns.msftncsi.com. (34)
185.228.168.168.53 > 10.8.3.2.36507: 55641 1/0/0 dns.msftncsi.com. A 131.107.255.255 (50)
10.8.3.2.50597 > 185.228.168.168.53: 29697+ A? dns.msftncsi.com. (34)
185.228.168.168.53 > 10.8.3.2.50597: 29697 1/0/0 dns.msftncsi.com. A 131.107.255.255 (50)
^C20443 packets captured
20509 packets received by filter
0 packets dropped by kernel
admin@RT-AX86U-4168:/tmp/home/root#
admin@RT-AX86U-4168:/tmp/home/root# tcpdump -vpni tun11 |grep -i google.com
tcpdump: listening on tun11, link-type RAW (Raw IP), capture size 262144 bytes
10.8.3.2.33411 > 185.228.168.168.53: 32861+ A? www.google.com. (32)
10.8.3.2.33411 > 185.228.168.168.53: 34397+ AAAA? www.google.com. (32)
185.228.168.168.53 > 10.8.3.2.33411: 32861 1/0/0 www.google.com. A 216.239.38.120 (48)
185.228.168.168.53 > 10.8.3.2.33411: 34397 1/0/0 www.google.com. AAAA 2001:4860:4802:32::78 (60)
10.8.3.2.39070 > 185.228.168.168.53: 59112+ A? www.google.com. (32)
10.8.3.2.39070 > 185.228.168.168.53: 60648+ AAAA? www.google.com. (32)
185.228.168.168.53 > 10.8.3.2.39070: 59112 1/0/0 www.google.com. A 216.239.38.120 (48)
185.228.168.168.53 > 10.8.3.2.39070: 60648 1/0/0 www.google.com. AAAA 2001:4860:4802:32::78 (60)
^C4965 packets captured
4968 packets received by filter
0 packets dropped by kernel
So I guess this would detect broken WAN state and force a restart_WAN?
I would still really like to understand why this is necessary and what is ultimately breaking the connection.