Roku DNS storm is impacting OPNsense

[RobertoZ]

I have a TCL TV that has Roku OS on it.  It's constantly very chatty.  I use ControlD for DNS so I have it blocked.  I tried disconnecting the TV from the network, but then there is a bright white light on the front of the TV that constantly flashes with the intensity of a thousand suns.

I looked for a new "dumb" TV with no smart features.  I quickly found out unless you want to buy a professional display costing almost as much as a car you are stuck with this scheiße. 

</rant>

[OPNenthu]

I looked for a new "dumb" TV with no smart features.  I quickly found out unless you want to buy a professional display costing almost as much as a car you are stuck with this scheiße. 

</rant>

It almost seems like the market is rigged so the rentiers and data brokers always win...

[lilsense]

I have a TCL TV that has Roku OS on it.  It's constantly very chatty.  I use ControlD for DNS so I have it blocked.  I tried disconnecting the TV from the network, but then there is a bright white light on the front of the TV that constantly flashes with the intensity of a thousand suns.

I looked for a new "dumb" TV with no smart features.  I quickly found out unless you want to buy a professional display costing almost as much as a car you are stuck with this scheiße. 

</rant>

You can stop by your local friendly hardware store if you do not have a black electrical tape and cut a tiny piece and place it on the bright LED. :) 
No smartTV should be on anyone's network, even the world's BEST SONY Android TV's. 

[nero355]

No smartTV should be on anyone's network

MWAHAHAHA!!!!! "It's funny because it's true!" :P

[OPNenthu]

Quick update-

The DNS storm seems to have stopped overnight but I'm not sure why.  All I had done was add a host override in Unbound with the black-hole IP, but I had removed it since it wasn't helping to calm the log spam.  Now it's back to just the DNSBL policy blocking the telemetry and it's acting normally.

I guess either there's some trigger for the storm that hasn't been hit yet, or something's been fixed (hopefully).

[keeka]

Quick update-

The DNS storm seems to have stopped overnight but I'm not sure why.

I wouldn't bet on it. When I first noticed the increase in  DNS queries, I left the roku powered down for a short period. After restarting, DNS queries remained low for some time, but eventually returned to once per second for each of various hosts in logs.roku.com. I don't see any performance hits at that level but it is rather irritating and does put me off buying more such devices.

[OPNenthu]

I had almost two months of relief from this but now I got a Monit alert email that the CPU was pegged.

It's Roku again.

Code Select Expand

# top

last pid: 94206;  load averages:  12.54,  12.19,    7.00                                          up 1+00:26:27  15:38:35
75 processes:  3 running, 72 sleeping
CPU: 97.8% user,  0.0% nice,  2.3% system,  0.0% interrupt,  0.0% idle
Mem: 937M Active, 1712M Inact, 2074M Laundry, 1646M Wired, 1151M Free
ARC: 705M Total, 221M MFU, 403M MRU, 532K Anon, 14M Header, 63M Other
    566M Compressed, 6726M Uncompressed, 11.89:1 Ratio
Swap: 8192M Total, 2265M Used, 5926M Free, 27% Inuse

  PID USERNAME    THR PRI NICE  SIZE    RES STATE    C  TIME    WCPU COMMAND
 4737 root        11 113    0  470M  371M CPU1    1  2:41 191.32% python3.13
 4013 root        11 111    0  514M  396M RUN      3  2:43 180.62% python3.13
48625 unbound      4  3    0  802M  376M kqread  1 191:11  19.53% unbound
17859 root          3  0    0    81M    36M kqread  1  14:54  1.34% syslog-ng
87088 root          1  0    0    14M  1748K bpf      3  13:56  1.33% filterlog
...

You cannot view this attachment.


I went back to post #4 and re-added the host override in Unbound.

I see from the query logs that the override is in effect (it's using "Source=Local-data"), but the client is still spamming so much that it's keeping the OPNsense CPU busy and the system temps elevated.

Code Select Expand

# top

last pid: 43681;  load averages:    6.45,    2.66,    2.83                                           up 1+00:52:34  16:04:42
77 processes:  3 running, 74 sleeping
CPU: 97.9% user,  0.0% nice,  2.0% system,  0.1% interrupt,  0.0% idle
Mem: 1176M Active, 1138M Inact, 1838M Laundry, 1680M Wired, 1689M Free
ARC: 724M Total, 243M MFU, 402M MRU, 1668K Anon, 14M Header, 64M Other
     583M Compressed, 6817M Uncompressed, 11.69:1 Ratio
Swap: 8192M Total, 2147M Used, 6045M Free, 26% Inuse

  PID USERNAME    THR PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
  750 root         11 111    0   443M   342M RUN      2   1:59 193.59% python3.13
   23 root         11 114    0   464M   367M CPU3     3   2:03 191.15% python3.13
 9890 unbound       4   0    0   617M   501M kqread   3   0:57   9.36% unbound
17859 root          3   0    0    85M    39M kqread   1  15:06   0.70% syslog-ng
87088 root          1   0    0    14M  1748K bpf      2  14:08   0.70% filterlog
...

Hopefully it calms down in some time but I may need to break down and install a standalone DNS there to get this load off of OPNsense.  As a last resort I'll consider disabling the telemetry blocks :(