2023 Sync attempting to access Chinese DNS server

[david_quick]

I have recently updated my network equipment. I have installed a Ubiquity UDR7 and a U7 Pro XG Wall in the garage. The garage is 70' from the house so the U7 is using a wired backhaul. In any case when looking at the Insights tab in Unifi I see that the Mach E is trying to go to a DNS server in China. I currently have all China traffic blocked. Will this cause an issue with the car getting updates?

Sponsored

 

[mikeinet]

What was the IP?

 

[Draco]

I am running a full Unifi network in my house, with PRC (and other) nations geo-blocked in the insights panel. Never had an issue was the Mach E running any updates or other services when connected to the home network. I am sure Ford is not using a PRC IP address for any of their network services. Just speculating - it might be Alexa or a Google app that is connected to the car?

 

[david_quick]

What was the IP?

There are 2, 102.52.131.32 and 202.160.140.32

I did a Whois lookup and they are definitely identified as Chinese.

 

[AliRafiee]

There are 2, 102.52.131.32 and 202.160.140.32

I did a Whois lookup and they are definitely identified as Chinese.

The 102 one came back as Morocco.

They might be data centers that Ford uses.

 

[dking1981]

Is the traffic UDP or TCP?

 

[Roger70]

Found this

 

[david_quick]

I am running a full Unifi network in my house, with PRC (and other) nations geo-blocked in the insights panel. Never had an issue was the Mach E running any updates or other services when connected to the home network. I am sure Ford is not using a PRC IP address for any of their network services. Just speculating - it might be Alex or a Google app that is connected to the car?

This is really what I was hoping to hear. Neither are active.

The 102 one came back as Morocco.

They might be data centers that Ford uses.

Hmmm, I’ll have to look at that one again. I block notorious traffic from/to countries home to large scale scammers and trolls.

Is the traffic UDP or TCP?

I’m away and I don’t see a way to view that info in the UniFi app. I’ll look when I get. Home.

 

[jefftuck]

The gtld servers are currently publishing 8 authoritative DNS servers for ford.com. Six of them are in Ford’s own /8 IP space. However, Ford is also publishing extdns009.ford.com and extdns010.ford.com which resolve to the Chinese and Moroccan networks you identified.

Big companies that want high availability will often replicate resources geographically to ensure that services stay up, even when there are regional problems. In this case, Asian customers may have better results resolving ford.com addresses if they do the lookup on the local server. Of course, individuals don’t control that but if they can’t reach the main ford network for some reason, maybe they can still look up ford.com addresses.

In your case, the alternative works as well. You can completely block access to these DNS servers. Your car will just see that as unresponsive DNS servers and try an alternative. There’s six other servers, all in a range owned by Ford, so you’ll pick up an address after, at most, a brief delay.

 

[benk016]

Those are possibly the only two servers that the cars in China can hit with China blocking a lot of foreign connections.

The cars use different software over there but potentially still send some info back Ford HQ. And potentially they leave them in for all cars just in Case for redundancy.

This is all a guess though.

 

[highland58]

I saw recently that asus routers were compromised and the only way to clear your router is to reset to factory defaults. Do you have an asus router by chance.?

 

[david_quick]

I saw recently that asus routers were compromised and the only way to clear your router is to reset to factory defaults. Do you have an asus router by chance.?

No, running a Ubiquity Dream router.

 

[jefftuck]

I saw recently that asus routers were compromised and the only way to clear your router is to reset to factory defaults. Do you have an asus router by chance.?

Doesn’t have anything to do with the router. Every device in the world that wants a ford.com IP address has a 2/8 chance of asking those two international servers first.

 

[jav_eee]

the PRC is coming for you!

Sponsored