It turned out that the Wi-Fi relay made by TP-Link was communicating 715 MB per month with frequent request frequent requests

byAdi Goldstein

Network equipment manufacturer ·TP-LinkWi-Fi (wireless LAN) repeaters have sent NTP queries to six servers every five seconds, and it is clear that 715.4 MB was communicated monthly. TP-Link is updating the firmware, and the problem is headed for solution.

About access to NTP server by TP-Link made wireless LAN repeater - TP-Link
http://www.tp-link.jp/news-details-17792.html


TP-Link repeater firmware squanders 715 MB / month - Ctrl blog
https://www.ctrl.blog/entry/tplink-aggressive-ntp

The problem occurred not "Wi-Fi router" of TP-Link but "Wi-Fi repeater". In order to confirm whether the repeater is connected to the Internet, we sent a request to the NTP server used for time synchronization. Although this operation itself has no problem which is done also in other network equipment and the like, the Windows client in the always-on connection environment sets the frequency of one DNS query and one NTP query "every once a week" On the contrary, the device in question was transmitting at a high frequency of "once every 5 seconds". By the way, it is said to be "quite frequent check" even in query transmission every 5 minutes.

According to Ctrl blog "1 .38 KB" traffic volume is very small as the amount of traffic for one query transmission, but by transmitting at a high frequency, the communication volume per day is 23.85 MB, and in the case of the month it is 715 MB It will swell up to. Even with the above "quite frequent check", the monthly communication volume is 11.92 MB, so you can see that this is a non-routine figure.

By the way, since the information is written in the firmware of this communication destination NTP server, it can not be rewritten by usual means by the user. In TP - Link, I contacted the NTP server provider including Fukuoka University and is working on reducing the load. Fukuoka University's NTP server has been flooded with access to network equipment other than TP-Link before, and it is de factoDoS attackIt was state and it was known that stakeholders are struggling.

Summary of Fukuoka University's public NTP server - Togetter
https://togetter.com/li/1182233

TP-Link updates the firmware so that it communicates with the NTP server only when accessing the management screen of the Wi-Fi relay, and is gradually applying the upgrade.