Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    So why is Netflix hitting me with Dradis?

    Scheduled Pinned Locked Moved IDS/IPS
    30 Posts 4 Posters 418 Views 5 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • tinfoilmattT Offline
      tinfoilmatt @johnpoz
      last edited by

      @johnpoz said in So why is Netflix hitting me with Dradis?:

      and just his iot using hard coded DNS

      Which you have no idea the purpose of. You're equally speculating.

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ Offline
        johnpoz LAYER 8 Global Moderator @tinfoilmatt
        last edited by johnpoz

        @tinfoilmatt

        Also if it was a company as big as Netflix doing something - why would they not just hide the traffic in their normal traffic vs doing a DNS query in the clear?

        This isn't speculation - its experience and common sense

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1

        tinfoilmattT 1 Reply Last reply Reply Quote 0
        • tinfoilmattT Offline
          tinfoilmatt @johnpoz
          last edited by

          @johnpoz You'd have to ask Netflix.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ Offline
            johnpoz LAYER 8 Global Moderator @tinfoilmatt
            last edited by

            @tinfoilmatt Sure go ask them.. Or its just a simple DNS query and not some form of trying to sneak something into your network.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1

            tinfoilmattT 1 Reply Last reply Reply Quote 0
            • tinfoilmattT Offline
              tinfoilmatt @johnpoz
              last edited by

              @johnpoz said in So why is Netflix hitting me with Dradis?:

              Or its just a simple DNS query and not some form of trying to sneak something into your network.

              Which, again, is equal speculation on your part.

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator @tinfoilmatt
                last edited by

                @tinfoilmatt Yeah I am just speculating that a dns query is just a dns query <rolleyes>

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1

                tinfoilmattT 1 Reply Last reply Reply Quote 0
                • tinfoilmattT Offline
                  tinfoilmatt @johnpoz
                  last edited by

                  @johnpoz said in So why is Netflix hitting me with Dradis?:

                  @tinfoilmatt Yeah I am just speculating that a dns query is just a dns query <rolleyes>

                  Your attempts to manipulate my words reveal the strength of your position.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • A Offline
                    aivxtla @johnpoz
                    last edited by aivxtla

                    You could block that if you want, but when they can't talk they tend to get more chatty about it - asking more and more often, etc..

                    Also a noob here myself lol. That's pretty much like my Netgear router despite being in AP mode, pretty much spams 8.8.8.8/8.8.4.4 for connectivity checks, even though its DNS in its web interface is set to the pfsense firewall which in turn is set to Cloudflare and Quad9. When 8.8.8.8/8.8.4.4 got blocked as part of the DoH IP list in pfblockerng it became even more aggressive and I had a spam of block alerts like every 3-5 secs if not more often at times lol. If I recall something similar happened when I had "Chromecast with Google TV" dongles a few years ago, so I'm not surprised.

                    tinfoilmattT 1 Reply Last reply Reply Quote 0
                    • tinfoilmattT Offline
                      tinfoilmatt @aivxtla
                      last edited by

                      @aivxtla My devices hammer connectivitycheck.gstatic.com, gsas.apple.com, bing.com, ngw.dvr163.com (a Chinese NVR), etc. all day long. It is what it is.

                      On this point specifically (i.e., DNSBL and/or IPBL), make sure to configure logging such that these queries/packets are 'sinked'.

                      1 Reply Last reply Reply Quote 1
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator @tinfoilmatt
                        last edited by johnpoz

                        @tinfoilmatt said in So why is Netflix hitting me with Dradis?:

                        strength of your position.

                        So you're saying it is malicious then? an iot device doing queries to a hard coded public DNS server, to a domain dradis.netflix.com

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1

                        tinfoilmattT 1 Reply Last reply Reply Quote 0
                        • tinfoilmattT Offline
                          tinfoilmatt @johnpoz
                          last edited by

                          @johnpoz OP's speculation that his TV querying a domain aliased to appboot.dradis.netflix.com is potentially nefarious, is equally as speculative as your 'position' that it's not.

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ Offline
                            johnpoz LAYER 8 Global Moderator @tinfoilmatt
                            last edited by johnpoz

                            @tinfoilmatt whatever - done here..

                            And the moon is not made of cheese is speculation the same as saying it is.

                            While mine is based on common sense and experience - his is based off what? His tinfoil hat.. He doesn't even understand the direction of the traffic flow..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 25.07.1 | Lab VMs 2.8.1, 25.07.1

                            tinfoilmattT 1 Reply Last reply Reply Quote 0
                            • tinfoilmattT Offline
                              tinfoilmatt @johnpoz
                              last edited by

                              @johnpoz said in So why is Netflix hitting me with Dradis?:

                              And the moon is not made of cheese is speculation the same as saying it is.

                              No. It's mostly rock. We've been there, and samples have come back.

                              If you simply want to call the person stupid for trying to understand and learn, then just have out and say it, John. You're not hiding it very well.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.