I have this old TP-Link smart lightbulb, it’s the only thing that’s IoT and on WiFi in my house.

Looking through pfBlocker logs for fun, and noticed it’s been trying to connect to the Tor network.

Oh! Also, it’s been uploading and downloading 100+ MB of data a day.

  • StarkZarn@infosec.pub
    link
    fedilink
    English
    arrow-up
    111
    arrow-down
    1
    ·
    9 months ago

    It’s just an NTP pool. The device is trying to update it’s time. Likely it made many other requests to other servers when this one didn’t work.

    Maintaining up to date lists of anything is a game of whack a mole, so you’re always going to get weird results.

    If you’re actually unsure, pcap the traffic on your pfsense box and see for yourself. NTP is an unencrypted protocol, so tshark or Wireshark will have no problem telling you all about it.

    That said, I’d still agree with the other poster about local integration with home assistant and just block that sucker from the Internet.

    • MonkderZweite@feddit.ch
      link
      fedilink
      arrow-up
      3
      ·
      9 months ago

      NTP is an unencrypted protocol, so tshark or Wireshark will have no problem telling you all about it.

      Wait, it is? Pretty sure chrony.conf has some auth stuff in it.

    • czardestructo@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      9 months ago

      Agreed. To add to this because the traffic is being blocked it keeps retrying so it’s inflating the traffic size. I have about 14 tplink WiFi switches on a vlan and my pfsense rule for NTP is less than 6 megabytes. OP is conflating legitimate NTP traffic with Tor.

    • lemming741@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      9 months ago

      Similar to forwarding all DNS traffic to my pihole, I also forward 123 to the opnsense NTP server.