Пользователь блокирует трафик умного дома через Pi-hole из-за подозрительного объема данных

Patrick Campanale has been in the tech space for well over a decade, specializing in PC/gaming news and reviews, as well as maker-focused products to build small businesses. With a start in technology back in 2010 surrounding the Palm/webOS ecosystem, Patrick spent his formative years developing mobile applications as well as blogging for various publications, eventually leading to starting his own website in 2014. After running a technology blog for a few years, he stepped out of that role and into the world of high-end custom PC manufacturing and building, with a focus on YouTube video production and overclocking. Then, six years ago, Patrick joined the 9to5Toys team as an editor/writer/reviewer with over 14,000 articles being published there there, ranging from deals and roundups to in-depth reviews on the latest technology, video games, 3D printers, and more. In his free time, Patrick loves to create projects from wood using various robots and methods, including leveraging the technologies of CNCs and lasers. If Patrick isn't working on a computer or playing video games, he's likely in his 2-car garage workshop creating something unique. In addition to all this, Patrick is also a youth pastor at his local church where he feels God has called him to serve, and he loves every minute of it. Do you know how many requests your smart devices make on your network? I didn't until I tracked it for 24 hours. Out of over 30 devices, just six smart plugs and switches used nearly 1.5GB of data and made nearly half a million DNS requests—in one single day. I tracked over 30 devices for a full day A managed network really helped handle the stats In early 2025, I moved my entire network from a normal, unmanaged network to a fully managed network. This means that I can have VLANs, more tracking, and my router knows what's going on with each port. Having a managed network also allows me to do things like track how much data is used by what device on a more granular level, which is exactly what I did for the past 24 hours. I was able to track over 30 smart devices on my home network—some on my IoT network, some on my normal network, and the results actually surprised me. My Apple TV predictably used the most data Unsurprisingly, streaming content takes a lot of data So, my Apple TV was one of the over 30 devices that I tracked on my network. The majority of the devices were smart home items, like smart switches, plugs, or even my appliances. To nobody's surprise, my Apple TV used the most data. In total, it used 2.19GB of data, receiving 2.02GB and transmitting 163MB. This makes sense as I use my Apple TV to stream Plex and YouTube almost every night for at least a few episodes of something to relax after work. However, the actual surprising part is what used the second-largest amount of data. Quiz 8 Questions · Test Your Knowledge DNS filtering and network privacy tools Trivia challenge From Pi-hole to Control D — how well do you know the tools that block ads and protect your network? DNSPrivacyNetworkingAd BlockingSecurity 01 / 8 Ad Blocking What is Pi-hole primarily designed to do? Correct! Pi-hole works as a DNS sinkhole, intercepting DNS queries for known ad-serving domains and returning a null response so ads never load. Because it operates at the network level, it blocks ads on every device connected to your router — including smart TVs and phones — without needing a browser extension. Not quite. Pi-hole is a DNS sinkhole, meaning it blocks ad-serving domains at the DNS level before your devices even attempt to connect to them. This makes it uniquely powerful because it works across your entire network, not just in a single browser. 02 / 8 DNS Which hardware platform is Pi-hole most famously associated with? Correct! Pi-hole was built with the Raspberry Pi in mind, and its name is literally a portmanteau of 'Raspberry Pi' and 'black hole.' The low cost and small footprint of a Raspberry Pi make it an ideal always-on DNS server for a home network, though Pi-hole also runs on many other Linux systems. Not quite. The 'Pi' in Pi-hole refers to the Raspberry Pi, the inexpensive single-board computer that inspired the project. The name cleverly combines 'Raspberry Pi' with 'black hole,' reflecting how it swallows ad requests before they can reach your devices. 03 / 8 Privacy What feature differentiates Control D from a basic DNS resolver like 8.8.8.8? Correct! Control D goes far beyond simple DNS resolution by letting users create custom filtering profiles that block categories like ads, malware, social media, or adult content. It also supports per-device routing rules and provides detailed query analytics, making it a powerful managed DNS service for both individuals and businesses. Not quite. Control D is a managed DNS service that layers advanced filtering and analytics on top of standard DNS resolution. Unlike a plain resolver such as Google's 8.8.8.8, it lets you define exactly what content is blocked or redirected, and even apply different rules to different devices on your network. 04 / 8 Security What does DNS-over-HTTPS (DoH) protect against compared to traditional DNS? Correct! Traditional DNS queries are sent in plain text, meaning your ISP, network admin, or anyone monitoring your traffic can see every domain you look up. DoH wraps those queries inside encrypted HTTPS traffic, making them indistinguishable from normal web browsing and shielding your browsing habits from snoops. Not quite. DNS-over-HTTPS is a privacy protocol, not a security or performance tool per se. It encrypts your DNS lookups inside standard HTTPS connections so that third parties on the network — like your ISP or a coffee shop operator — cannot see which domains you are querying. 05 / 8 Networking What is the purpose of a blocklist in tools like Pi-hole or AdGuard Home? Correct! Blocklists are the heart of DNS-based filtering tools. They are community-maintained or commercially curated databases of domains associated with advertising networks, trackers, phishing sites, or malware distribution. When a device queries one of these domains, the DNS filter returns a fake or null address, preventing the connection entirely. Not quite. In DNS filtering, a blocklist is a database of known bad or unwanted domains — ad servers, trackers, and malware hosts. The DNS filter consults this list on every query and silently drops requests for listed domains, which is why Pi-hole can report blocking millions of queries per day on an active home network. 06 / 8 Ad Blocking AdGuard Home is often compared to Pi-hole. What is one key built-in feature AdGuard Home offers that Pi-hole historically lacked out of the box? Correct! AdGuard Home was designed from the ground up with encrypted DNS support built in, allowing it to act as a local DoH or DoT server without additional software. Pi-hole originally required pairing with a separate tool like Unbound to gain similar encrypted upstream capabilities, though the gap between the two projects has narrowed over time. Not quite. One of AdGuard Home's headline advantages has been native support for encrypted DNS protocols — DNS-over-HTTPS and DNS-over-TLS — both for upstream resolvers and for clients connecting to it. Pi-hole users who wanted the same functionality traditionally had to install Unbound or another resolver alongside it. 07 / 8 DNS What does the term 'upstream DNS resolver' mean in the context of Pi-hole or AdGuard Home? Correct! Pi-hole and AdGuard Home sit between your devices and the internet, filtering out blocked domains. For everything that is not blocked, they need to forward the query to a real DNS resolver — the upstream — such as Cloudflare (1.1.1.1), Google (8.8.8.8), or a local recursive resolver like Unbound. The upstream is what actually looks up the IP address and returns it. Not quite. An upstream DNS resolver is the server your filtering tool consults whenever a query is not on the blocklist. Think of Pi-hole as a bouncer at the door — blocked domains never get in, but for everything else it passes the question along to the upstream resolver, which does the actual DNS lookup and returns the answer. 08 / 8 Security What is a DNS rebinding attack, and which type of tool is specifically designed to help mitigate it? Correct! In a DNS rebinding attack, a malicious website first resolves to a legitimate external IP, then quickly changes its DNS response to an internal IP like 192.168.1.1 — effectively turning your browser into a proxy that can talk to devices on your local network. Pi-hole and AdGuard Home both include DNS rebinding protection that rejects responses containing private IP ranges for public domain names. Not quite. DNS rebinding is a clever attack where a hacker's domain first points to their own server, then switches its DNS record to point at an IP inside your home network. Your browser, already trusting the domain, then happily sends requests to your router or other local devices. DNS filtering tools counter this by blocking any public domain that resolves to a private IP address range. Challenge Complete Your Score / 8 Thanks for playing! Six Wemo switches moved 1.42GB I still don't know why they downloaded nearly 1GB of data... I have two Wemo smart plugs and four Wemo switches in my house. Can someone tell me why they used nearly 1.5GB of data in just 24 hours? I've tried to find the root cause, but the problem is most of the data transmissions are encrypted so even with packet sniffers I can't quite track down exactly what they're doing. I do have them connected via Home Assistant, and the Wemo cloud is shut down, but, somehow, in a 24 hour period, my Wemo devices received 966MB and sent 449MB. Five of the devices were a lot busier than the sixth, but still, the traffic was almost continuous with a bunch of small packets it seems. I did some digging and it seems like local automations or multicast discovery could account for the data, but still, it's a little unsettling to find out that the Wemo devices were transmitting that much data, especially when Pi-hole reports more than 423,000 DNS requests in one day. There is a possibility that some of this data was retries on the network since the cloud service was shut down, but it's still data used on the network at the end of the day, which could affect those who are on a metered network connection. My next step is to completely block the Wemo devices from accessing anything not on my local network since I control them through Home Assistant or HomeKit and the Wemo cloud is shut down. Most appliances used very little data My fridge only used 1.59MB. Yes, my fridge. So far, I've talked about seven devices out of over 30. I have a lot of smart devices on my network, including things like my Samsung fridge, a Pura diffuser, two WiZ smart plugs, and several others. While Wemo was a surprise for how much data it transmitted, the other devices basically transmitted almost nothing. For instance, my Samsung fridge only used a total of 1.59MB in 24 hours. The Pura diffuser only used 1.81MB total. Both of my Wyze smart plugs used less than 1MB each, and my C660 camera mounted above my garage door used around 0.5MB. This usage pattern definitely surprised me, especially the Samsung fridge. I'm not sure why I expected that to use more data than it did, but I definitely expected more than 1.59MB. At the end of the day, some devices transmit a ton of data, and some simply don't. My router could show volume, but not intent Tracking how much data is easy, but tracking exactly what was in that data is not as simple While I wish I could see exactly what was transmitted, that's not as easy as it sounds. You can sometimes set up a mirroring system to capture a mirror copy of packets sent, but, even then, some packets are encrypted which means you can't see everything. The thing is, I don't need to see everything. I just need to know that my Wemo devices are using gigabytes of data per month, and that I want to put a stop to that. I've basically moved my smart home to be controlled entirely locally. I use HomeKit as my base of operations, and Home Assistant brings the non-HomeKit devices into the fold for me. Since HomeKit handles devices locally (most of the time), and Home Assistant does the same, I will be adding the domains that the smart devices reach out to into my Pi-hole's block list. I just don't want dozens of gigabytes of data leaving my network going who knows where when it's unnecessary. I don't need to see what's in them to know I want to block these requests Even though I can't see what's being sent on my network, I know for sure that smart plugs and switches shouldn't be moving over 1GB of data and making 423,000 DNS requests in one day. So, it's time to set up some blocks on the network. Puts on tinfoil hat.