Tenda MW6 mesh is talking to baidu -what is it doing?

Question

I recently picked up a set of tenda MW6 mesh units - I'm running this in "bridged" mode, since that's the only option that turns off their dhcp server. The primary mesh unit connected to a DIY linux router (ubuntu, with firewalld. The full setup is here) - which allows me to run a few more interesting tools to monitor my traffic. The linux router provides DHCP and DNS and has 3 ports bridged together to a single interface, and the primary mesh unit is on one of these ports. I can apparently run tcpdump and pick up traffic going through the mesh units.

I'm running the mesh units in bridged mode, if that matters, and the backhaul to the secondaries are over wireless. The tendas are managed through a phone application but its local, with no cloud accounts set up.

                Router - Runs ubuntu + firewalld
                192.168.1.1
                  +
                  |
                  |
                  |
                  v
                  Primary Mesh Node (Tenda MW6) 192.168.1.99
                   +
 Secondary         |        Secondary
192.168.1.91 <-----+-----> 192.168.1.87

I noticed using iftop that the devices talk to 45.113.192.102 - an IP that seems to belong to a chinese search engine called baidu, and tcpdump indicates that all 3 nodes are connecting to the IP over http. Tenda claims that its a way to check for internet connectivity

01:43:00.987943 IP 192.168.1.99.34783 > 45.113.192.102.http: Flags [F.], seq 1, ack 1, win 913, length 0

is an example of the output of tcpdump at my main router.

Running tcpdump (sudo tcpdump -i br0 host 45.113.192.102 -s 0 -w dumpfile )and running the dump through wireshark shows

No.     Time           Source                Destination           Protocol Length Info
      1 0.000000       192.168.1.99          45.113.192.102        TCP      66     36256 → 80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=16
      2 0.071250       45.113.192.102        192.168.1.99          TCP      66     80 → 36256 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1452 SACK_PERM=1 WS=32
      3 0.075499       192.168.1.99          45.113.192.102        TCP      60     36256 → 80 [ACK] Seq=1 Ack=1 Win=14608 Len=0
      4 0.075573       192.168.1.99          45.113.192.102        TCP      60     36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
      5 0.352218       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
      6 0.632204       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
      7 1.192806       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
      8 2.312628       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
      9 2.893126       192.168.1.99          45.113.192.102        TCP      60     36255 → 80 [FIN, ACK] Seq=1 Ack=1 Win=913 Len=0
     10 4.552308       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     11 5.732298       192.168.1.99          45.113.192.102        TCP      60     36254 → 80 [FIN, ACK] Seq=1 Ack=1 Win=913 Len=0
     12 9.042919       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     13 11.373253      192.168.1.99          45.113.192.102        TCP      60     36252 → 80 [FIN, ACK] Seq=1 Ack=1 Win=913 Len=0
     14 15.155209      192.168.1.99          45.113.192.102        TCP      66     36257 → 80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=16
     15 15.227698      45.113.192.102        192.168.1.99          TCP      66     80 → 36257 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1452 SACK_PERM=1 WS=32
     16 15.231005      192.168.1.99          45.113.192.102        TCP      60     36257 → 80 [ACK] Seq=1 Ack=1 Win=14608 Len=0
     17 15.231078      192.168.1.99          45.113.192.102        TCP      60     36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     18 15.492991      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     19 15.763425      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     20 16.303042      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     21 17.382364      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     22 18.013092      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     23 19.542368      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     24 23.893447      192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36257 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0
     25 26.493192      192.168.1.99          45.113.192.102        TCP      60     36253 → 80 [FIN, ACK] Seq=1 Ack=1 Win=913 Len=0

And the packets look something like

No.     Time           Source                Destination           Protocol Length Info
      1 0.000000       192.168.1.99          45.113.192.102        TCP      66     36256 → 80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 WS=16

Frame 1: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
Ethernet II, Src: TendaTec_56:35:08 (04:95:e6:56:35:08), Dst: Gifa_01:07:60 (40:62:31:01:07:60)
Internet Protocol Version 4, Src: 192.168.1.99, Dst: 45.113.192.102
Transmission Control Protocol, Src Port: 36256, Dst Port: 80, Seq: 0, Len: 0
    Source Port: 36256
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgment number: 0
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x002 (SYN)
    Window size value: 14600
    [Calculated window size: 14600]
    Checksum: 0x6b93 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), No-Operation (NOP), SACK permitted, No-Operation (NOP), Window scale

No.     Time           Source                Destination           Protocol Length Info
      2 0.071250       45.113.192.102        192.168.1.99          TCP      66     80 → 36256 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1452 SACK_PERM=1 WS=32

Frame 2: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
Ethernet II, Src: Gifa_01:07:60 (40:62:31:01:07:60), Dst: TendaTec_56:35:08 (04:95:e6:56:35:08)
Internet Protocol Version 4, Src: 45.113.192.102, Dst: 192.168.1.99
Transmission Control Protocol, Src Port: 80, Dst Port: 36256, Seq: 0, Ack: 1, Len: 0
    Source Port: 80
    Destination Port: 36256
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 0    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x012 (SYN, ACK)
    Window size value: 8192
    [Calculated window size: 8192]
    Checksum: 0xfa3d [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    Options: (12 bytes), Maximum segment size, No-Operation (NOP), No-Operation (NOP), SACK permitted, No-Operation (NOP), Window scale
    [SEQ/ACK analysis]

No.     Time           Source                Destination           Protocol Length Info
      3 0.075499       192.168.1.99          45.113.192.102        TCP      60     36256 → 80 [ACK] Seq=1 Ack=1 Win=14608 Len=0

Frame 3: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: TendaTec_56:35:08 (04:95:e6:56:35:08), Dst: Gifa_01:07:60 (40:62:31:01:07:60)
Internet Protocol Version 4, Src: 192.168.1.99, Dst: 45.113.192.102
Transmission Control Protocol, Src Port: 36256, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
    Source Port: 36256
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x010 (ACK)
    Window size value: 913
    [Calculated window size: 14608]
    [Window size scaling factor: 16]
    Checksum: 0x5775 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]

No.     Time           Source                Destination           Protocol Length Info
      4 0.075573       192.168.1.99          45.113.192.102        TCP      60     36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0

Frame 4: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: TendaTec_56:35:08 (04:95:e6:56:35:08), Dst: Gifa_01:07:60 (40:62:31:01:07:60)
Internet Protocol Version 4, Src: 192.168.1.99, Dst: 45.113.192.102
Transmission Control Protocol, Src Port: 36256, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
    Source Port: 36256
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x011 (FIN, ACK)
    Window size value: 913
    [Calculated window size: 14608]
    [Window size scaling factor: 16]
    Checksum: 0x5774 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0

No.     Time           Source                Destination           Protocol Length Info
      5 0.352218       192.168.1.99          45.113.192.102        TCP      60     [TCP Retransmission] 36256 → 80 [FIN, ACK] Seq=1 Ack=1 Win=14608 Len=0

Frame 5: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: TendaTec_56:35:08 (04:95:e6:56:35:08), Dst: Gifa_01:07:60 (40:62:31:01:07:60)
Internet Protocol Version 4, Src: 192.168.1.99, Dst: 45.113.192.102
Transmission Control Protocol, Src Port: 36256, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
    Source Port: 36256
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgment number: 1    (relative ack number)
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x011 (FIN, ACK)
    Window size value: 913
    [Calculated window size: 14608]
    [Window size scaling factor: 16]
    Checksum: 0x5774 [unverified]
    [Checksum Status: Unverified]
    Urgent pointer: 0
    [SEQ/ACK analysis]

There's no apparent payload

Is there any way I can check what the traffic is, and what's happening??

Answer 1

It appears it's just checking to see if it's online and can get to 45.113.192.102 on port 80.

Presumably this is just the AP doing it's 'The internet is accessible' test, such as you often see with Windows (where it'll connect to a Microsoft address).

As can be seen in every packet - there's no data as shown by the LEN=0.

3 0.075499 192.168.1.99 45.113.192.102 TCP 60 36256 → 80 [ACK] Seq=1 Ack=1 Win=14608 Len=0

If there was data it'd normally be stored within this part of the packet. They could be doing something by such as hiding encrypted information in the sequence numbers of the packets they generate, but this would be extremely slow and unlikely for this kind of device.

It's possible that they respond with some data payload if there's a firmware update or some such, in which case you'd see data coming back in these packets:

15 15.227698 45.113.192.102 192.168.1.99 TCP 66 80 → 36257 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1452 SACK_PERM=1 WS=32

but currently they appear to be empty, and beign.

You could block access to 45.113.192.102, or a larger subnet as you desire, but this may cause the AP to think it's either offline, or failing to connect correctly in someway and cause more trouble than it's worth.