# Round 3: What Really Happens On Your Network?

**URL:** <https://discourse.pi-hole.net/t/round-3-what-really-happens-on-your-network/3982>\
**Category:** Announcements\
**Created:** [July 6, 2017, 7:52pm UTC](https://discourse.pi-hole.net/t/round-3-what-really-happens-on-your-network/3982 "2017-07-06T19:52:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![postmaster](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/postmaster/32/11_2.png) [@postmaster](https://discourse.pi-hole.net/u/postmaster)\
**Post date:** [July 6, 2017, 7:52pm UTC](https://discourse.pi-hole.net/t/round-3-what-really-happens-on-your-network/3982/1 "2017-07-06T19:52:34Z")

</div>

Originally published at: [https://pi-hole.net/2017/07/06/round-3-what-really-happens-on-your-network/](https://pi-hole.net/2017/07/06/round-3-what-really-happens-on-your-network/)

# Here we [are](https://pi-hole.net/2017/02/22/what-really-happens-on-your-network-find-out-with-pi-hole/) [again](https://pi-hole.net/2017/05/31/what-really-happens-on-your-network-redux/)

Using Pi-hole, users have **discovered unexpected, strange, or disturbing things happening on their network**. In fact, so many things have been discovered (and discussed publicly), that this is our third time posting a list of things people have found happening on their networks.

- [Part **one** : What Really Happens On Your Network?](https://pi-hole.net/2017/02/22/what-really-happens-on-your-network-find-out-with-pi-hole/)
- [Part **two** : What Really Happens On Your Network?](https://pi-hole.net/2017/05/31/what-really-happens-on-your-network-redux/)
- [Part **three** : What Really Happens On Your Network?](https://pi-hole.net/2017/07/06/round-3-what-really-happens-on-your-network/)
- [Part **four** : What Really Happens On Your Network?](https://pi-hole.net/2017/09/01/part-4-what-really-happens-on-your-network/)
- [Part **five** : What Really Happens On Your Network?](https://pi-hole.net/2017/11/26/part-5-what-really-happens-on-your-network/)
- [Part **six** : What Really Happens On Your Network?](https://pi-hole.net/2018/01/08/what-really-happens-on-your-network-part-6/)
- [Part **seven** : What Really Happens On Your Network?](https://pi-hole.net/2018/09/14/what-really-happens-on-your-network-part-seven/)
- [Part **eight** : What Really Happens On Your Network?](https://pi-hole.net/2018/09/19/what-really-happens-on-your-network-part-eight/)

&nbsp;

# Preface

This post--and it's predecessors--are meant to be educational in nature; you may not know what is happening on your network, but Pi-hole can provide some insight.

Pi-hole is an ad blocker, but since it works on the DNS level, it can double as a network monitoring tool. There are several apps specifically designed to view network traffic; using Pi-hole for this purpose just provides a high level overview such as which client queried which domain.

# Onto The Examples

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/e/1/e104690fd5117a9110bc41f44dd5197a79263892.jpeg)

## Smart TVs And Other Devices Gone Wild

This isn't the first time we've seen Smart TVs querying domains, "calling home", or even spying on you, but it is interesting because most of the time you would not see this sort of behavior since these devices often don't let you adjust the DNS settings.

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/e/3/e3f139d968feb33cd54a327af02bf15147d4fd29.png)

- [A FirestickTV querying Netflix even when in sleep mode](https://discourse.pi-hole.net/t/amazon-firestick-huge-number-of-netflix-requests/3471)
- [The LG TV that likes Netflix even when it's not being used](https://www.reddit.com/r/pihole/comments/6f29ts/my_lg_smart_tv_really_likes_netflix_whether_or/)
- [The Chinese phone that (tried) to leak data to baidu.com](https://www.reddit.com/r/pihole/comments/6i4ppv/my_chinese_phone_is_leaking_data_to_baidu_without/)
- [The Sony Bravia TV looking for advertisements to show you](https://twitter.com/dreesclark/status/873548503162683393)
- [The Vivint alarm that likes to make sure spacemonkey is still around](https://www.reddit.com/r/pihole/comments/6go9n8/looks_like_my_vivint_alarm_panel_likes_to_call/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/b/7/b7e5eafb97217e150246a484ba8618670da4dba8.png)

- [A Sony 4K TV with 50,000 queries to flingo.tv](https://www.reddit.com/r/pihole/comments/6iw4xl/massive_increase_from_flingotv/)
- [Another Samsung TV sending out a lot of queries](https://www.reddit.com/r/pihole/comments/6jdoxa/iscdnco_bulk_dns_requests/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/0/c/0c90df8c5846f69df552cd5c9ffb9c7648fffc2c.jpeg)

## Networking Hardware Queries

In the previous posts, many users had their routers calling home, or sending out an absurd amount of queries. It seems to continue...

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/4/c/4cecebd3762ee0d5cd6441a5cd56e030f3d8b428.jpeg)

&nbsp;

- [The Wi-Fi extender asking what time it was 800 times per hour](https://www.reddit.com/r/pihole/comments/6ge769/thanks_to_pihole_i_discovered_my_recently/)
- [The TP-Link router that phoned home more than ET](https://www.reddit.com/r/pihole/comments/6gc9re/xpost_from_rraspberry_pi_pihole_made_me_realize/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/1/2/12b367320f10d98b54483ac433b737b1ab6c7710.png)

- [pfSense querying a strange domain name (34.203.250)](https://www.reddit.com/r/pihole/comments/6fhj4n/domain_34203250_requested_by_pfsense/)
- [The offline NAS that is a pain-in-the-NAS](https://www.reddit.com/r/pihole/comments/6hnvse/my_offline_nas_is_making_a_ton_of_requests/)
- [Netgear and Roku](https://www.reddit.com/r/pihole/comments/6gfeye/for_everyone_out_there_using_netgear_and_possibly/)

## ![|514x226](upload://n6TZS1nnPkrdI8uF9WFGePI4eSL.png)

## ISP Behavior

- [Excessive queries for comcast.net](https://www.reddit.com/r/pihole/comments/6fa3ak/should_i_be_concerned_what_is_comcastnet/)
- [Is this ISP using Pi-hole for their customers?](https://www.reddit.com/r/pihole/comments/6i3ksr/unknown_pihole_on_network/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/d/c/dce1f2019b48839695dfdecbf7fd090c39e2907c.png)

## Guests On Your Network

- [When your friend joins your network and floods your Pi-hole with 33,000 queries in two hours](https://www.reddit.com/r/pihole/comments/6imlh7/flood_of_dns_requests_virus/)..._something_ is going on here.
- [Spike in DNS queries when a friend connects his smartphone](https://www.reddit.com/r/pihole/comments/6j4jv9/how_can_i_find_out_which_android_app_is_causing/)

## Other Random Examples

- [Chromecast querying {GUID}.local domain](https://www.reddit.com/r/pihole/comments/6hqrec/lots_of_random_look_ups_to_local_domains/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/e/0/e024fef0680a246f23f6e3c8ca1f0ef210777a67.png)

- [Found a strange client using Pi-hole](https://www.reddit.com/r/pihole/comments/6ifygg/just_started_seeing_requests_from_odd_client_no/)
- [A phone contacting appboy.com every few hours](https://www.reddit.com/r/pihole/comments/6ikb1f/phone_contacting_devappboycom_every_few_hours/)
- [Top domains are udp and http](https://www.reddit.com/r/pihole/comments/6el8s1/what_is_happening_here_top_domains_udp_and_http/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/b/4/b4d00dec5c980f452ac723caa79b27ceb7780ee9.png)

- [77,000 requests from localhost](https://www.reddit.com/r/pihole/comments/6endp6/77k_requests_from_localhost/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/3/f/3f18fbf8cd68edcdc6db78dabcb13f3f746d1065.png) ![](https://discourse.pi-hole.net/uploads/default/original/3X/7/e/7ed714341cd9e2a6317d1fd6e08b4235f03bc33b.png)

- [Anti-cheating domain queried every second causing 10,000 queries](https://www.reddit.com/r/pihole/comments/6j47as/anyone_play_iracing_with_pihole/)
- [Windows 10 contacting the mother ship thousands of times](https://www.reddit.com/r/pihole/comments/6j50am/windows_10_trying_to_phone_home_to_the_mothership/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/0/1/01021553729e0b541d6a5d41d1af43b997bee618.png)

- [Teamviewer going berserk!](https://www.reddit.com/r/pihole/comments/6kimai/my_internet_connection_went_down_this_afternoon/)

 ![](https://discourse.pi-hole.net/uploads/default/original/3X/0/d/0d89750ca9e2d2d359cfde1d8c1468c3e65541db.jpeg)

&nbsp;

&nbsp;

---

<div class="post-metadata">

**Author:** ![jacob.salmela](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jacob.salmela/32/8_2.png) [@jacob.salmela](https://discourse.pi-hole.net/u/jacob.salmela)\
**Post date:** [July 6, 2017, 7:58pm UTC](https://discourse.pi-hole.net/t/round-3-what-really-happens-on-your-network/3982/2 "2017-07-06T19:58:20Z")

</div>



---

<div class="post-metadata">

**Author:** ![DerMauch](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dermauch/32/1705_2.png) [@DerMauch](https://discourse.pi-hole.net/u/DerMauch)\
**Post date:** [July 20, 2017, 10:37am UTC](https://discourse.pi-hole.net/t/round-3-what-really-happens-on-your-network/3982/3 "2017-07-20T10:37:47Z")

</div>

You might be interested in this little discovery of mine: [https://www.reddit.com/r/RetroPie/comments/64cy0d/lots\_of\_requests\_to\_mumucnckozowcom/](https://www.reddit.com/r/RetroPie/comments/64cy0d/lots_of_requests_to_mumucnckozowcom/)

TL;DR The Pi got infected because I accidentally left port 22 open with default password.

---

<div class="post-metadata">

**Author:** ![jacob.salmela](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jacob.salmela/32/8_2.png) [@jacob.salmela](https://discourse.pi-hole.net/u/jacob.salmela)\
**Post date:** [July 21, 2017, 3:45am UTC](https://discourse.pi-hole.net/t/round-3-what-really-happens-on-your-network/3982/4 "2017-07-21T03:45:41Z")

</div>

Thanks! I'll add it to round 4.