CINXE.COM
TP Link RE305 v3 - massive data use over weekend - Networking - Spiceworks Community
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>TP Link RE305 v3 - massive data use over weekend - Networking - Spiceworks Community</title> <meta name="description" content="Significant data from TP Link Wi-Fi Range extenders. I have inherited x5 TP Link Wi-Fi Range extenders RE305 v3. They are running the latest version of their firmware. They have static IP addresses etc on them, in a ran&hellip;"> <meta name="generator" content="Discourse 3.4.0.beta3-dev - https://github.com/discourse/discourse version 8210c4c6494dfe80b134d248980f3cc372296035"> <link rel="icon" type="image/png" href="https://global.discourse-cdn.com/spiceworks/optimized/1X/a254df83358a951c43ed6ee756b5e0011a8d58bc_2_32x32.png"> <link rel="apple-touch-icon" type="image/png" href="https://global.discourse-cdn.com/spiceworks/optimized/1X/7a73606d7df2f794c4789897e49693fb3c471b23_2_180x180.png"> <meta name="theme-color" media="(prefers-color-scheme: light)" content="#ffffff"> <meta name="theme-color" media="(prefers-color-scheme: dark)" content="#080809"> <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, user-scalable=yes, viewport-fit=cover"> <link rel="canonical" href="https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687" /> <link rel="search" type="application/opensearchdescription+xml" href="https://community.spiceworks.com/opensearch.xml" title="Spiceworks Community Search"> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/color_definitions_spiceworks-light_9_30_fbbac6b14d7bfd3904205db01e91f13a47854748.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" class="light-scheme"/><link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/color_definitions_dark_1_30_14e077de2b45a6017f1f096087d1236aa9ae46e8.css?__ws=community.spiceworks.com" media="(prefers-color-scheme: dark)" rel="stylesheet" class="dark-scheme"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/automation_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="automation" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/chat_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="chat" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/checklist_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="checklist" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-ai_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-ai" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-akismet_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-akismet" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-bbcode_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-bbcode" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-cakeday_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-cakeday" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-calendar_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-calendar" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-data-explorer_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-data-explorer" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-details_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-details" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-follow_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-follow" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-gamification_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-gamification" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-lazy-videos_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-lazy-videos" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-livestream_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-livestream" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-local-dates_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-local-dates" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-narrative-bot_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-narrative-bot" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-presence_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-presence" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-rss-polling_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-rss-polling" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-saved-searches_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-saved-searches" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-solved_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-solved" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-spiceworks-ads_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-spiceworks-ads" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-templates_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-templates" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-user-notes_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-user-notes" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/footnote_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="footnote" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/hosted-site_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="hosted-site" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/poll_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="poll" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/spoiler-alert_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="spoiler-alert" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/chat_desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="chat_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-ai_desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-ai_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-calendar_desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-calendar_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-gamification_desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-gamification_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-livestream_desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-livestream_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/poll_desktop_adea2d1ba8e75f390b51ebcebb4ebbf1e72d75d7.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="poll_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_24_cfddc80970ae01f2758c5d4ed42fe5756761adf5.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="24" data-theme-name="category headers theme component"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_35_04855c075a92c4357222dd7f04b59ba65c75f095.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="35" data-theme-name="category icons"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_29_1586fb170d6a2363385d3d22194f8fe215383abc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="29" data-theme-name="custom spiceworks"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_7_9a0e75da6740cd9a2efd29af139e3d386c9beaff.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="7" data-theme-name="dropdown header - spiceworks edition"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_25_2c2ee49468f76ad9c4fe355ae185c512ae0616d8.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="25" data-theme-name="featured posts"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_37_2b621f73f6f52d75a260c58fc6981c6fe28454c6.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="37" data-theme-name="follow category button"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_33_a6fd813d6dabed78af76e80c3772321dd6b9d893.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="33" data-theme-name="guest gate theme component"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_27_618e7daf193c95987f029283d6aaf0269dc54bcc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="27" data-theme-name="spiceworks footer"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_32_6024842603dd5f3bbef707659400bbdc3b5dd965.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="32" data-theme-name="sw daily challenge"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_26_4187ecb93e8dd127fd2ed44ab14d47b20bc6e10c.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="26" data-theme-name="sw discourse profile page custom links"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_21_d7e2be3df8ce066ecee22dc4753ae225673e8ab8.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="21" data-theme-name="sw promotions"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_28_cb5fd0428d2a1de557b41d8a220be6e66f2d9b96.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="28" data-theme-name="sw user title and color for user groups"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_23_5a01b74e31354af307bfb081083549a906116c11.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="23" data-theme-name="sw-right-sidebar"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_20_4f336d5e8ba26367c620f3029a7c1be82d1b0154.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="20" data-theme-name="tag banners"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_34_ea5faa7a23b861fad25b63b572402bef93945f3b.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="34" data-theme-name="tag icons"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_30_33b127ddb8f56eecc3c48f3861295750ad1fdb79.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="30" data-theme-name="spiceworks (production)"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_39_3157d503bdea44fa4402d27d8fe1b4f939fbaa38.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="39" data-theme-name="livestream-ads"/> <!-- Google Tag Manager --> <!-- End Google Tag Manager --> <link rel="preload" href="https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js" as="script"><script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/5056370bc31bf58348723fbcbb56f3c7b8b1123e.js?__ws=community.spiceworks.com" data-theme-id="29" nonce="1G5PXpXmI6uJ0pmzGzvhLGNWP"></script> <script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/96bd4879f7e2a5d38864677369649e8128ecea7c.js?__ws=community.spiceworks.com" data-theme-id="38" nonce="1G5PXpXmI6uJ0pmzGzvhLGNWP"></script> <link rel="alternate nofollow" type="application/rss+xml" title="RSS feed of 'TP Link RE305 v3 - massive data use over weekend'" href="https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687.rss" /> <meta property="og:site_name" content="Spiceworks Community" /> <meta property="og:type" content="website" /> <meta name="twitter:card" content="summary" /> <meta name="twitter:image" content="https://global.discourse-cdn.com/spiceworks/original/1X/7a73606d7df2f794c4789897e49693fb3c471b23.png" /> <meta property="og:image" content="https://global.discourse-cdn.com/spiceworks/original/1X/7a73606d7df2f794c4789897e49693fb3c471b23.png" /> <meta property="og:url" content="https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687" /> <meta name="twitter:url" content="https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687" /> <meta property="og:title" content="TP Link RE305 v3 - massive data use over weekend" /> <meta name="twitter:title" content="TP Link RE305 v3 - massive data use over weekend" /> <meta property="og:description" content="Significant data from TP Link Wi-Fi Range extenders. I have inherited x5 TP Link Wi-Fi Range extenders RE305 v3. They are running the latest version of their firmware. They have static IP addresses etc on them, in a range outside of the DHCP scope. The site is a school and has a /24 public IP block from their ISP. The RE305 has a public IP xx.yy.zzz.43 The devices are connected to LAN data points and are being used as WAPs. I did not order these, but also do not have a budget yet to replace th..." /> <meta name="twitter:description" content="Significant data from TP Link Wi-Fi Range extenders. I have inherited x5 TP Link Wi-Fi Range extenders RE305 v3. They are running the latest version of their firmware. They have static IP addresses etc on them, in a range outside of the DHCP scope. The site is a school and has a /24 public IP block from their ISP. The RE305 has a public IP xx.yy.zzz.43 The devices are connected to LAN data points and are being used as WAPs. I did not order these, but also do not have a budget yet to replace th..." /> <meta property="og:article:section" content="Networking" /> <meta property="og:article:section:color" content="0088CC" /> <meta property="og:article:tag" content="question" /> <meta name="twitter:label1" value="Reading time" /> <meta name="twitter:data1" value="1 mins 🕑" /> <meta name="twitter:label2" value="Spice ups" /> <meta name="twitter:data2" value="1 ❤" /> <meta property="article:published_time" content="2024-11-23T17:07:03+00:00" /> <meta property="og:ignore_canonical" content="true" /> <script type="application/ld+json">{"@context":"http://schema.org","@type":"QAPage","mainEntity":{"@type":"Question","name":"TP Link RE305 v3 - massive data use over weekend","text":"<p>Significant data from TP Link Wi-Fi Range extenders.<\/p>\n<p>I have inherited x5 TP Link Wi-Fi Range extenders RE305 v3. They are running the latest version of their firmware. They have static IP addresses etc on them, in a range outside of the DHCP scope. The site is a school and has a /24 public IP block from their ISP. The RE305 has a public IP xx.yy.zzz.43<\/p>\n<p>The devices are connected to LAN data points and are being used as WAPs. I did not order these, but also do not have a budget yet to replace them. For now, I am just ensuring that there are no more purchased.<\/p>\n<p>I observed through the monitoring logs in the switch that they connect to them using large amounts of data over the weekend. Approx 3TB per day, between x5 devices.<\/p>\n<p>I took a port mirror from the switch, and performed a packet capture for 30 minutes using Wireshark. I can see data such as the one anonymised below happening 4-5 times per second. The device at .1 is the router. It is not performing the DHCP server role.<\/p>\n<p>2024-11-19 15:08:12\txx.yy.zzz.33\txx.yy.zzz.1\tICMP\t98\tEcho (ping) request id=0x6c02, seq=0/0, ttl=64 (reply in 624839)<\/p>\n<p>Sometimes I can see a reply, and other times there is no response found.<\/p>\n<p>I looked through the log on the RE305s. Here are a sample from the same time as the packet capture.<\/p>\n<p>2024-11-19 15:14:30 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:13:30 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:12:44 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:11:38 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:10:31 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:09:33 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:08:29 dhcpc:Received a DHCP offer:Server ID is 54.Assigned IP address is xx.yy.zzzz.150<br>\n2024-11-19 15:07:37 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:06:33 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:05:30 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:04:31 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:03:41 dhcpc:Sent a detection for DHCP.<\/p>\n<p>I am going to perform a port scan for any open ports on the xx.yy.zzz.43 IP address both from the LAN and from outside the network.<\/p>\n<p>There are a number of others of these around the school that have their default IP addresses of 198.168.1.1 and are not consuming this data. I have not looked through the logs.<\/p>\n<p>I know there has been publicity around some TP Link devices being part of botnets recently, but I can’t find these devices included in any articles. I also cannot find anything in the packet capture that would suggest botnet, during that 30 minute period.<\/p>\n<p>I am wondering whether the short time answer is to put them into a different subnet so that they can’t ping the default gateway?<\/p>\n<p>Whether I should factory reset them?<\/p>\n<p>I also wonder what the maximum data they could be using in 24 hours is just with ICMP requests at 5 per second. Could that achieve 600 gigbytes per device? I wonder where there is another issue at play here also.<\/p>","upvoteCount":0,"answerCount":3,"datePublished":"2024-11-23T17:07:03.047Z","author":{"@type":"Person","name":"spice-yfuac","url":"https://community.spiceworks.com/u/spice-yfuac"},"suggestedAnswer":[{"@type":"Answer","text":"<p>Significant data from TP Link Wi-Fi Range extenders.<\/p>\n<p>I have inherited x5 TP Link Wi-Fi Range extenders RE305 v3. They are running the latest version of their firmware. They have static IP addresses etc on them, in a range outside of the DHCP scope. The site is a school and has a /24 public IP block from their ISP. The RE305 has a public IP xx.yy.zzz.43<\/p>\n<p>The devices are connected to LAN data points and are being used as WAPs. I did not order these, but also do not have a budget yet to replace them. For now, I am just ensuring that there are no more purchased.<\/p>\n<p>I observed through the monitoring logs in the switch that they connect to them using large amounts of data over the weekend. Approx 3TB per day, between x5 devices.<\/p>\n<p>I took a port mirror from the switch, and performed a packet capture for 30 minutes using Wireshark. I can see data such as the one anonymised below happening 4-5 times per second. The device at .1 is the router. It is not performing the DHCP server role.<\/p>\n<p>2024-11-19 15:08:12\txx.yy.zzz.33\txx.yy.zzz.1\tICMP\t98\tEcho (ping) request id=0x6c02, seq=0/0, ttl=64 (reply in 624839)<\/p>\n<p>Sometimes I can see a reply, and other times there is no response found.<\/p>\n<p>I looked through the log on the RE305s. Here are a sample from the same time as the packet capture.<\/p>\n<p>2024-11-19 15:14:30 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:13:30 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:12:44 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:11:38 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:10:31 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:09:33 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:08:29 dhcpc:Received a DHCP offer:Server ID is 54.Assigned IP address is xx.yy.zzzz.150<br>\n2024-11-19 15:07:37 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:06:33 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:05:30 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:04:31 dhcpc:Sent a detection for DHCP.<br>\n2024-11-19 15:03:41 dhcpc:Sent a detection for DHCP.<\/p>\n<p>I am going to perform a port scan for any open ports on the xx.yy.zzz.43 IP address both from the LAN and from outside the network.<\/p>\n<p>There are a number of others of these around the school that have their default IP addresses of 198.168.1.1 and are not consuming this data. I have not looked through the logs.<\/p>\n<p>I know there has been publicity around some TP Link devices being part of botnets recently, but I can’t find these devices included in any articles. I also cannot find anything in the packet capture that would suggest botnet, during that 30 minute period.<\/p>\n<p>I am wondering whether the short time answer is to put them into a different subnet so that they can’t ping the default gateway?<\/p>\n<p>Whether I should factory reset them?<\/p>\n<p>I also wonder what the maximum data they could be using in 24 hours is just with ICMP requests at 5 per second. Could that achieve 600 gigbytes per device? I wonder where there is another issue at play here also.<\/p>","upvoteCount":0,"datePublished":"2024-11-23T17:07:03.131Z","url":"https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687/1","author":{"@type":"Person","name":"spice-yfuac","url":"https://community.spiceworks.com/u/spice-yfuac"}},{"@type":"Answer","text":"<aside class=\"quote no-group\" data-username=\"spice-yfuac\" data-post=\"1\" data-topic=\"1145687\">\n<div class=\"title\">\n<div class=\"quote-controls\"><\/div>\n<img loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/48.png\" class=\"avatar\"> spice-yfuac:<\/div>\n<blockquote>\n<p>The RE305 has a public IP xx.yy.zzz.43<\/p>\n<\/blockquote>\n<\/aside>\n<p>Why would a range extender have or need a public IP?<\/p>\n<p>If these do in-fact have a public IP, I’d get them off that on to the LAN ranges.<\/p>\n<aside class=\"quote no-group\" data-username=\"spice-yfuac\" data-post=\"1\" data-topic=\"1145687\">\n<div class=\"title\">\n<div class=\"quote-controls\"><\/div>\n<img loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/48.png\" class=\"avatar\"> spice-yfuac:<\/div>\n<blockquote>\n<p>I also wonder what the maximum data they could be using in 24 hours is just with ICMP requests at 5 per second. Could that achieve 600 gigbytes per device?<\/p>\n<\/blockquote>\n<\/aside>\n<p>Short answer, no, not even close.<br>\n5 ICMP requests per second, over 24 hours would be approximately 0.0258 GB.<br>\nSo less than 30MB.<\/p>","upvoteCount":1,"datePublished":"2024-11-23T17:19:58.636Z","url":"https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687/2","author":{"@type":"Person","name":"Rod-IT","url":"https://community.spiceworks.com/u/Rod-IT"}},{"@type":"Answer","text":"<p>They should not be able to be managed if they have a public IP inside your network. It would have no route to get out. Regardless that’s a misconfiguration that would need to be corrected.<\/p>\n<p>Are machines connected to it doing windows updates perhaps?<\/p>","upvoteCount":0,"datePublished":"2024-11-24T00:18:15.606Z","url":"https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687/3","author":{"@type":"Person","name":"PatrickFarrell","url":"https://community.spiceworks.com/u/PatrickFarrell"}}]}}</script><script type="application/ld+json">[{"@context":"http://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":"https://community.spiceworks.com/c/networking/23","name":"Networking"},{"@type":"ListItem","position":2,"item":"https://community.spiceworks.com/tag/question","name":"question"},{"@type":"ListItem","position":3,"item":"https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687","name":"TP Link RE305 v3 - massive data use over weekend"}]}]</script> </head> <body class="crawler browser-update"> <script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/01223c6d02b16adad7d31f26ce4c503435f7656e.js?__ws=community.spiceworks.com" data-theme-id="24" nonce="1G5PXpXmI6uJ0pmzGzvhLGNWP"></script> <header> <a href="/"> Spiceworks Community </a> </header> <div id="main-outlet" class="wrap" role="main"> <div id="topic-title"> <h1> <a href="/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687">TP Link RE305 v3 - massive data use over weekend</a> </h1> <div class="topic-category" itemscope itemtype="http://schema.org/BreadcrumbList"> <span itemprop="itemListElement" itemscope itemtype="http://schema.org/ListItem"> <a href="/c/networking/23" class="badge-wrapper bullet" itemprop="item"> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name' itemprop='name'>Networking</span> </span> </a> <meta itemprop="position" content="1" /> </span> </div> <div class="topic-category"> <div class='discourse-tags list-tags'> <a href='https://community.spiceworks.com/tag/question' class='discourse-tag' rel="tag">question</a> </div> </div> </div> <div itemscope itemtype='http://schema.org/DiscussionForumPosting'> <meta itemprop='headline' content='TP Link RE305 v3 - massive data use over weekend'> <link itemprop='url' href='https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687'> <meta itemprop='datePublished' content='2024-11-23T17:07:03Z'> <meta itemprop='articleSection' content='Networking'> <meta itemprop='keywords' content='question'> <div itemprop='publisher' itemscope itemtype="http://schema.org/Organization"> <meta itemprop='name' content='Spiceworks Inc.'> <div itemprop='logo' itemscope itemtype="http://schema.org/ImageObject"> <meta itemprop='url' content='https://global.discourse-cdn.com/spiceworks/original/4X/a/6/b/a6bdb5fb57f6080b918e219f9f8f79bfbbefa176.svg'> </div> </div> <div id='post_1' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/spice-yfuac'><span itemprop='name'>spice-yfuac</span></a> (spice-yfuac) </span> <link itemprop="mainEntityOfPage" href="https://community.spiceworks.com/t/tp-link-re305-v3-massive-data-use-over-weekend/1145687"> <span class="crawler-post-infos"> <time datetime='2024-11-23T17:07:03Z' class='post-time'> November 23, 2024, 5:07pm </time> <meta itemprop='dateModified' content='2024-11-23T17:07:03Z'> <span itemprop='position'>1</span> </span> </div> <div class='post' itemprop='text'> <p>Significant data from TP Link Wi-Fi Range extenders.</p> <p>I have inherited x5 TP Link Wi-Fi Range extenders RE305 v3. They are running the latest version of their firmware. They have static IP addresses etc on them, in a range outside of the DHCP scope. The site is a school and has a /24 public IP block from their ISP. The RE305 has a public IP xx.yy.zzz.43</p> <p>The devices are connected to LAN data points and are being used as WAPs. I did not order these, but also do not have a budget yet to replace them. For now, I am just ensuring that there are no more purchased.</p> <p>I observed through the monitoring logs in the switch that they connect to them using large amounts of data over the weekend. Approx 3TB per day, between x5 devices.</p> <p>I took a port mirror from the switch, and performed a packet capture for 30 minutes using Wireshark. I can see data such as the one anonymised below happening 4-5 times per second. The device at .1 is the router. It is not performing the DHCP server role.</p> <p>2024-11-19 15:08:12 xx.yy.zzz.33 xx.yy.zzz.1 ICMP 98 Echo (ping) request id=0x6c02, seq=0/0, ttl=64 (reply in 624839)</p> <p>Sometimes I can see a reply, and other times there is no response found.</p> <p>I looked through the log on the RE305s. Here are a sample from the same time as the packet capture.</p> <p>2024-11-19 15:14:30 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:13:30 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:12:44 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:11:38 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:10:31 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:09:33 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:08:29 dhcpc:Received a DHCP offer:Server ID is 54.Assigned IP address is xx.yy.zzzz.150<br> 2024-11-19 15:07:37 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:06:33 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:05:30 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:04:31 dhcpc:Sent a detection for DHCP.<br> 2024-11-19 15:03:41 dhcpc:Sent a detection for DHCP.</p> <p>I am going to perform a port scan for any open ports on the xx.yy.zzz.43 IP address both from the LAN and from outside the network.</p> <p>There are a number of others of these around the school that have their default IP addresses of 198.168.1.1 and are not consuming this data. I have not looked through the logs.</p> <p>I know there has been publicity around some TP Link devices being part of botnets recently, but I can’t find these devices included in any articles. I also cannot find anything in the packet capture that would suggest botnet, during that 30 minute period.</p> <p>I am wondering whether the short time answer is to put them into a different subnet so that they can’t ping the default gateway?</p> <p>Whether I should factory reset them?</p> <p>I also wonder what the maximum data they could be using in 24 hours is just with ICMP requests at 5 per second. Could that achieve 600 gigbytes per device? I wonder where there is another issue at play here also.</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="0" /> <span class='post-likes'></span> </div> </div> <div id='post_2' itemprop='comment' itemscope itemtype='http://schema.org/Comment' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/Rod-IT'><span itemprop='name'>Rod-IT</span></a> (Rod-IT) </span> <span class="crawler-post-infos"> <time itemprop='datePublished' datetime='2024-11-23T17:19:58Z' class='post-time'> November 23, 2024, 5:19pm </time> <meta itemprop='dateModified' content='2024-11-23T17:19:58Z'> <span itemprop='position'>2</span> </span> </div> <div class='post' itemprop='text'> <aside class="quote no-group" data-username="spice-yfuac" data-post="1" data-topic="1145687"> <div class="title"> <div class="quote-controls"></div> <img loading="lazy" alt="" width="24" height="24" src="https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/48.png" class="avatar"> spice-yfuac:</div> <blockquote> <p>The RE305 has a public IP xx.yy.zzz.43</p> </blockquote> </aside> <p>Why would a range extender have or need a public IP?</p> <p>If these do in-fact have a public IP, I’d get them off that on to the LAN ranges.</p> <aside class="quote no-group" data-username="spice-yfuac" data-post="1" data-topic="1145687"> <div class="title"> <div class="quote-controls"></div> <img loading="lazy" alt="" width="24" height="24" src="https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/48.png" class="avatar"> spice-yfuac:</div> <blockquote> <p>I also wonder what the maximum data they could be using in 24 hours is just with ICMP requests at 5 per second. Could that achieve 600 gigbytes per device?</p> </blockquote> </aside> <p>Short answer, no, not even close.<br> 5 ICMP requests per second, over 24 hours would be approximately 0.0258 GB.<br> So less than 30MB.</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="1" /> <span class='post-likes'>1 Spice up</span> </div> </div> <div id='post_3' itemprop='comment' itemscope itemtype='http://schema.org/Comment' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/PatrickFarrell'><span itemprop='name'>PatrickFarrell</span></a> (PatrickFarrell) </span> <span class="crawler-post-infos"> <time itemprop='datePublished' datetime='2024-11-24T00:18:15Z' class='post-time'> November 24, 2024, 12:18am </time> <meta itemprop='dateModified' content='2024-11-24T00:18:15Z'> <span itemprop='position'>3</span> </span> </div> <div class='post' itemprop='text'> <p>They should not be able to be managed if they have a public IP inside your network. It would have no route to get out. Regardless that’s a misconfiguration that would need to be corrected.</p> <p>Are machines connected to it doing windows updates perhaps?</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="0" /> <span class='post-likes'></span> </div> </div> </div> <div id="related-topics" class="more-topics__list " role="complementary" aria-labelledby="related-topics-title"> <h3 id="related-topics-title" class="more-topics__list-title"> Related topics </h3> <div class="topic-list-container" itemscope itemtype='http://schema.org/ItemList'> <meta itemprop='itemListOrder' content='http://schema.org/ItemListOrderDescending'> <table class='topic-list'> <thead> <tr> <th>Topic</th> <th></th> <th class="replies">Replies</th> <th class="views">Views</th> <th>Activity</th> </tr> </thead> <tbody> <tr class="topic-list-item" id="topic-list-item-92525"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='1'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/unknown-excess-usage-adsl-connection/92525' class='title raw-link raw-topic-link'>Unknown Excess Usage - ADSL connection</a> </span> <div class="link-bottom-line"> <a href='/c/networking/23' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Networking</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/general-networking' class='discourse-tag'>general-networking</a> , <a href='https://community.spiceworks.com/tag/question' class='discourse-tag'>question</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>11</span> </td> <td class="views"> <span class='views' title='views'>135</span> </td> <td> June 21, 2011 </td> </tr> <tr class="topic-list-item" id="topic-list-item-694521"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='2'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/high-data-usage-on-broadband-wifi/694521' class='title raw-link raw-topic-link'>High data usage on broadband WiFi</a> </span> <div class="link-bottom-line"> <a href='/c/networking/23' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Networking</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/general-networking' class='discourse-tag'>general-networking</a> , <a href='https://community.spiceworks.com/tag/internet-service-providers-isp' class='discourse-tag'>internet-service-providers-isp</a> , <a href='https://community.spiceworks.com/tag/question' class='discourse-tag'>question</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>13</span> </td> <td class="views"> <span class='views' title='views'>172</span> </td> <td> January 27, 2019 </td> </tr> <tr class="topic-list-item" id="topic-list-item-595100"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='3'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/internet-data-usage-very-high-and-increasing/595100' class='title raw-link raw-topic-link'>Internet Data usage Very High and increasing</a> </span> <div class="link-bottom-line"> <a href='/c/networking/23' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Networking</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/discussion' class='discourse-tag'>discussion</a> , <a href='https://community.spiceworks.com/tag/general-networking' class='discourse-tag'>general-networking</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>14</span> </td> <td class="views"> <span class='views' title='views'>120</span> </td> <td> September 12, 2017 </td> </tr> <tr class="topic-list-item" id="topic-list-item-667878"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='4'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/mystery-ip-address/667878' class='title raw-link raw-topic-link'>Mystery IP Address</a> </span> <div class="link-bottom-line"> <a href='/c/networking/23' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Networking</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/general-networking' class='discourse-tag'>general-networking</a> , <a href='https://community.spiceworks.com/tag/question' class='discourse-tag'>question</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>13</span> </td> <td class="views"> <span class='views' title='views'>237</span> </td> <td> August 21, 2018 </td> </tr> <tr class="topic-list-item" id="topic-list-item-382554"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='5'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/network-data-monitor/382554' class='title raw-link raw-topic-link'>Network data monitor</a> </span> <div class="link-bottom-line"> <a href='/c/networking/23' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Networking</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/discussion' class='discourse-tag'>discussion</a> , <a href='https://community.spiceworks.com/tag/general-networking' class='discourse-tag'>general-networking</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>7</span> </td> <td class="views"> <span class='views' title='views'>22</span> </td> <td> February 25, 2015 </td> </tr> </tbody> </table> </div> </div> </div> <footer class="container wrap"> <nav class='crawler-nav'> <ul> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='/' itemprop="url">Home </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='/categories' itemprop="url">Categories </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='/guidelines' itemprop="url">Guidelines </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='https://www.spiceworks.com/terms' itemprop="url">Terms of Service </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='https://www.spiceworks.com/privacy' itemprop="url">Privacy Policy </a> </span> </li> </ul> </nav> <p class='powered-by-link'>Powered by <a href="https://www.discourse.org">Discourse</a>, best viewed with JavaScript enabled</p> </footer> <noscript> <img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=6488140&fmt=gif"> </noscript> <script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/b488d0bc271fc4584be7d0599ed4675117022f39.js?__ws=community.spiceworks.com" data-theme-id="27" nonce="1G5PXpXmI6uJ0pmzGzvhLGNWP"></script> <!-- Google Tag Manager (noscript) --> <noscript> <iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KTKRL68F" height="0" width="0" style="display:none;visibility:hidden"></iframe> </noscript> <!-- End Google Tag Manager (noscript) --> <noscript><img height="1" width="1" src="//zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ/" alt=""></noscript> <div class="buorg"><div>Unfortunately, <a href="https://www.discourse.org/faq/#browser">your browser is unsupported</a>. Please <a href="https://browsehappy.com">switch to a supported browser</a> to view rich content, log in and reply.</div></div> <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8e759c89adfd4977',t:'MTczMjQxMTU5My4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body> </html>