I have an old spared raspberry pi board at the corner, in most the time it will sit there quietly. The monitored bandwidth curve is regular low.
But from some day on, i have noticed these are many irregular spikes on the bandwidth curve. I wonder what the hell is going on? Is there some spy program work in background?
Ok, today I dig into it. Then I notice most traffic is inbound, not outbound.
Open tcpdump, and wait....After a while, i caught it up. When i unlock my nexus 6p phone, it received endless mDns requests for the google cast device.
22:16:15.675580 IP 192.168.99.124.5353 > 18.104.22.168.5353: 1191 [2q] PTR (QM)? _%9E5E7C8F47989526C9BCD95D24084F6F0B27C5ED._sub._googlecast._tcp.local. PTR (QM)? _googlecast._tcp.local. (94) 22:16:15.755588 IP 192.168.99.124.5353 > 22.214.171.124.5353: 15558 [2q] PTR (QM)? _%9E5E7C8F47989526C9BCD95D24084F6F0B27C5ED._sub._googlecast._tcp.local. PTR (QM)? _googlecast._tcp.local. (94)
I can't find any setting on the phone to close or reduce the query.
I have no choice, but remove the mdns service on the pi, then it will not receive any mdns request.
sudo apt-get remove avahi-daemon
The world is quiet again!