search

moonlight-stream / moonlight-android

GameStream client for Android
GNU General Public License v3.0
4.31k stars 686 forks source link

[Issue]: Firestick DNS querry spam #1296

Open azsenca opened 11 months ago

azsenca commented 11 months ago

Describe the bug

On android version 12.0.1 and onward when closing app, and sometimes during operation, DNS querry spam is initated for some reason and 500-600 DNS requests are generated in few second that some routers marks as DDoS attack and goes into protection. For that reason internet is not working for some time, until router clears DNS requests. This happens on OpenWRT and Belkin RT3200.

I have tried on Firestick 4k, Firestick 4K Max and Firestick Cube (new version), all of them on latest FireOS. All of them are doing same DNS spam. In OpenWRT logs I have found lots of DNS requests towards dns.msftncsi.com if it helps

I have installed version 12.0 via ADB Link and it is not causing problems like that. It is working normally, as expected, without DNS querry spam.

Steps to reproduce

I will write exact steps I made during testing:

After that internet did not work for me on any device connected to my router for about 5 minutes, and in OpenWRT logs I had these:

Wed Dec 20 17:25:06 2023 daemon.warn dnsmasq[1]: Maximum number of concurrent DNS queries reached (max: 150)
Wed Dec 20 17:25:41 2023 daemon.warn dnsmasq[1]: Maximum number of concurrent DNS queries reached (max: 150)
Wed Dec 20 17:25:47 2023 daemon.warn dnsmasq[1]: Maximum number of concurrent DNS queries reached (max: 150)

Affected games

All of them (app problem, not game)

Other Moonlight clients

PC

Moonlight adjusted settings

Yes

Moonlight adjusted settings (please complete the following information)

Check steps to reproduce

Moonlight default settings

Yes

Gamepad-related connection issue

Yes

Gamepad-related input issue

Yes

Gamepad-related streaming issue

Yes

Android version

Fire OS 7.6.6.4, Android 14

Device model

Firestick 4K Max, Google Pixel 6 Pro

Server PC OS version

Windows 11 - Not related

Server PC GeForce Experience version

Sunshine 0.21 - Not related

Server PC Nvidia GPU driver version

537.13 - Not related

Server PC antivirus and firewall software

None

Screenshots

No response

Relevant log output

No response

Additional context

I tested bunch on other (cheap tablets, phones) android devices and I am having same problem with Moonlight version 12.0.1 and onward.

cgutman commented 11 months ago

I highly doubt this is a Moonlight bug. That hostname belongs to Microsoft and is used for their Internet connectivity testing. It's not contained anywhere inside any of Moonlight's source code. There are also tons of reports on the Internet of DNS query spam to dns.msftncsi.com, so it seems it's a relatively common issue.

The only hosts Moonlight will ever reach out to are *.moonlight-stream.org addresses for STUN and port blocking tests.

FWIW, I'm not seeing this behavior here on my network. I have my Android devices using a private DoT server and I don't see dns.msftncsi.com in the logs at all (which is expected since that's a Microsoft domain and Google uses other ones for Android).

The fact that it occurs when closing Moonlight is more evidence that it's something the OS is doing (such as trying to load new content when returning to the home launcher).

For that reason internet is not working for some time, until router clears DNS requests.

My guess is that you have the cause and effect reversed. I'll bet your connection goes down first, and that's why you get a flurry of Internet connectivity requests as apps try to load content, fail, and wait for connectivity to come back to retry.

azsenca commented 11 months ago

DNS I mentioned is just info what I see, but can be also false positive as log may not be updated when DNS spam ocurs. What IS the issue is that DNS spam is only triggered when exiting app (sometimes also during runtime) version 12.0.1 and 12.0.2. Version 12.0 does not trigger it.

It may be (sure is) OS bug, but for some reason only last two versions triggers it. Did exit, streaming stop code changed?

I am available if you want me to do some additional test...