Voxel [R7800] Voxel OpenVPN connection and msftncsi issues

[HELLO_wORLD]

This could be interesting for you to read too… https://www.snbforums.com/threads/network-flooded-by-dns-msftncsi-com-requests.61155/

Maybe also try to install the @kamoj Addon and disable all the Netgear services that are calling home, maybe it is one of them.

 

[NoFish]

Will do. Do I understand correct that the @kamoj addon is only available for beta testers?

 

[HELLO_wORLD]

Will do. Do I understand correct that the @kamoj addon is only available for beta testers?

Yes, you need to contact @kamoj

 

[NoFish]

Yes, you need to contact @kamoj

Will do, thanks!

 

[kamoj]

Hi, and welcome to the SNB forum!

I don't know if you have resolved your issue yet, but here is some information about msftncsi:
(nsci = Network Connectivity Status Indicator)

msftncsi is used by the router web-server uhttpd (/usr/sbin/uhttpd).
At times it tries to download http://www.msftncsi.com/ncsi.txt

This is also a common practice by all Microsoft products, e.g.
Skype, Office 365, Outlook, Microsoft Feedback Hub, Microsoft Store, Cortana, OneDrive, Defender,
Xbox Console Companion app (and all games there) - but not Windows Update.
This is what determines the state of the windows system tray network indicator icon.

It's also used by 3rd party applications such as
Adobe, Google, Spotify, Drobox, and gaming platforms.

Microsoft stores logs of all accesses to www.msftncsi.com!
These logs contain the time of each access and the IP address recorded for that access.

PS
Similar requests/downloads are done by other manufacturers as well, eg:
Apple devices request : http://captive.apple.com/hotspot-detect.html
Google devices request: http://connectivitycheck.gstatic.com/generate_204

 

[HELLO_wORLD]

Hi, and welcome to the SNB forum!

I don't know if you have resolved your issue yet, but here is some information about msftncsi:
(nsci = Network Connectivity Status Indicator)

msftncsi is used by the router web-server uhttpd (/usr/sbin/uhttpd).
At times it tries to download http://www.msftncsi.com/ncsi.txt

This is also a common practice by all Microsoft products, e.g.
Skype, Office 365, Outlook, Microsoft Feedback Hub, Microsoft Store, Cortana, OneDrive, Defender,
Xbox Console Companion app (and all games there) - but not Windows Update.
This is what determines the state of the windows system tray network indicator icon.

It's also used by 3rd party applications such as
Adobe, Google, Spotify, Drobox, and gaming platforms.

Microsoft stores logs of all accesses to www.msftncsi.com!
These logs contain the time of each access and the IP address recorded for that access.

PS
Similar requests/downloads are done by other manufacturers as well, eg:
Apple devices request : http://captive.apple.com/hotspot-detect.html
Google devices request: http://connectivitycheck.gstatic.com/generate_204

In @NoFish situation though, it seems that he is flooded by requests to www.msftncsi.com when he has his Entware USB plugged in in the router. We figured out that no Entware process was running, so it seems related to the fact of having a USB drive plugged in…

@NoFish did you try to plug another USB thumb drive (empty) to see if it is coming from the router itself, or if it could be the consequence of the auto mount script on the Entware drive for example?

 

[NoFish]

@HELLO_wORLD Good suggestion, I'll try to dig up an USB to see what it does.

@kamoj the pinging itself isn't the issue, as you said there are many application which do this, but it was the excessive amount of pings within a short timeframe, flooding the logs.

The fact it only happens when plugin a USB in the router is worth the research as well I think. Either way an interesting excuse to explore and a great way to learn how to mitigate these questions in networking.