DEV Community

NXVL
NXVL

Posted on Originally published at nxvalue.com

I`m sorry but your device is acting kinda..wired..

#discuss #security

H..Have you ever thought who your device chats with behind your back?

Right now your phone is face-down on the table, looking innocent, while it makes small talk with servers you have never met. Your TV is doing the same. So is the smart plug you bought in a moment of optimism and forgot about.

Nobody invited them to the group chat. They started it themselves.

The good news: you can read the minutes of the meeting, no hoodie required. Every one of those chats starts with a DNS lookup, and a resolver can write each one down.

Step 1: Hire a resolver that takes notes

You need a resolver with a query log that records the client, the name, the record type and the result. Pi-hole and AdGuard Home both do. Hosted filters like NextDNS and Control D do too, and you can also run your own private node, which is what I do with NxValue Stack (yes, that one is ours, so weigh my opinion accordingly).

The catch is NAT. If every query reaches the resolver through your router, the log shows the whole house as one very busy client. To get a per-device view, either let the resolver hand out DHCP leases so it knows each device by name, point each device at it directly, or use an engine that supports per-client identifiers.

Step 2: Leave it alone and make tea

Use your devices normally, then stop touching them. Idle traffic is the interesting part. A day shows the pattern, and a week catches the weekly habits, like the TV that checks in when it thinks you are asleep.

To watch it live on a machine you control, sudo tcpdump -n -i any port 53 prints every plain DNS query leaving that host, which is a fun way to see how chatty one laptop is.

Step 3: Read the log like a detective

A typical entry looks like this (illustrative, with made-up names):

10:02:11  tv-livingroom   A      metrics.example-vendor.net   blocked
10:02:11  tv-livingroom   AAAA   metrics.example-vendor.net   blocked
10:02:14  tv-livingroom   A      updates.example-vendor.net   allowed
Enter fullscreen mode Exit fullscreen mode

Things worth noticing:

  • Fixed intervals. A query every 60 seconds on the dot is a heartbeat or status check. Normal, but it tells you how the device behaves.
  • A burst of different names. Often an app or device starting up. A sustained flood is worth a look.
  • Repeated failures. Lots of NXDOMAIN for random-looking names can mean a broken config, or a device retrying something that is blocked or gone.
  • Paired A and AAAA queries. Normal: one asks for IPv4, the other for IPv6.

Most names fall into five characters:

  • The Plumbers. Connectivity checks and time sync, like connectivitycheck.gstatic.com (Android), captive.apple.com (Apple) and pool.ntp.org. Boring and necessary.
  • The Vendor's Staff. Updates and cloud features.
  • The Delivery Crew. Long names from CDNs and cloud hosts. Usually fine.
  • The Gossips. Advertising, analytics and telemetry.
  • The Mystery Guests. Names you do not recognise. Search before you judge.

Ask of each device: does this make sense for what it does? A lightbulb chatting with an advertising network deserves a raised eyebrow.

Step 4: Show the Gossips the door (carefully)

Blocking is easy. Not breaking your TV afterwards is the real skill.

  • Block a few names at a time, not the whole internet.
  • Know what a blocked answer looks like. Filters usually reply with 0.0.0.0 or NXDOMAIN. Some devices retry hard after a failure, which shows up as a spike for that domain.
  • Use the device afterwards. If something breaks, find the blocked name in the log and allow it again.

Some limits to know about

  • Names, not content. You can see who the TV called, not what it said.
  • A weird domain is a clue, not a verdict. Plenty of odd names belong to boring cloud providers.
  • Some devices skip your DNS with a hardcoded resolver or built-in DoH. A suspiciously quiet device may be talking elsewhere. Routers can redirect or block outbound port 53 to catch the hardcoded ones, but DoH on port 443 is much harder to spot.
  • CNAME cloaking. A tracker can hide behind a name on the site's own domain, using a CNAME that points to the tracker. Some filters can inspect the chain and block it, but not all do.
  • Not a full ad blocker. Ads served from the same domain as the content, like YouTube or Twitch video ads, cannot be separated at DNS level.
  • Home only sees home. To keep filtering on mobile data, the resolver needs encrypted endpoints (DoT or DoH) your phone can reach anywhere.

Summary

  • Your devices talk constantly, and DNS is the easiest place to listen in.
  • A resolver with a per-device log shows who asked for what, as long as NAT does not hide the client.
  • Read for patterns: intervals, bursts, failures, and names that do not fit the device.
  • Block gradually, test each change, and remember the limits: hardcoded DNS, DoH and CNAME cloaking can all slip past.
  • The first look at your log is usually hilarious and slightly unsettling.

Pi-hole is a registered trademark of Pi-hole LLC. AdGuard Home is a trademark of AdGuard Software Limited. NextDNS and Control D are trademarks of their respective owners. NxValue Stack is an independent service provider and is not affiliated with or sponsored by any of these projects or companies.

Top comments (0)