LIFX Bulb Uploading a lot of data

Can anyone explain why 2 of my bulbs would upload Gigabytes worth of data.

It seems to be uploading about 100MB per hour:

Shows Mac Address:

Confirmed MAC Address is LIFX:

1 Like

Which model is it? It sounds awfully like its been compromised. I hope LIFX replies ASAP with a plausible explanation other than that before the rumours begin to spread. @daniel_hall?

My assumption is that this is one of the lights we have that support Alljoyn. Part of the requirements for the AllJoyn specification is that devices (the ones that don’t provide a router) should search for a router on the local network. So this traffic is likely the LIFX Bulb scanning for an AllJoyn router so that it can join the local AllJoyn network. These scans will not be forwarded to the internet by your router (unless your router software has a bug). The bulbs that support AllJoyn are Color 1000, White 800, White 900 BR30 and Color 1000 BR30.

The other thing that I’m assuming here is that those traffic graphs represent local network traffic not uploads to the internet. Given how much traffic is here it should be pretty easy to match this against your ISPs recorded data and confirm if your internet connection is actually uploading this amount. But my research on the Asus AC3200 does indicate that this represents traffic that passes through the network bridge, and not the routing components, which confirms my assumption.

If I’ve gotten anything wrong here please do let me know. I’ve seen a few users report this and this has what it turns out to be every time.

1 Like

The odd part is that only these two bulbs were tracked doing such a thing. I have over 35 bulbs in my house. My router says that this is SSL/TLS Traffic. executing a Netstat on the router itself says that the bulbs are connected to Google Cloud. Since I have an unmanaged switch, I cannot configure a port for monitor mode and use wireshark to see more information about the traffic itself.

I don’t believe the AllJoyn protocol uses SSL/TLS or even the same port number as SSL/TLS.

Every bulb that I have is the latest 1100 Lumen Bulbs.

AT&T shows that I’ve been uploading ~15GB per day.

I’ll have to change my hardware to do a bit more analysis on whats going on. It was just strange that these 2 bulbs out of about 35 bulbs were doing this.

Yeah the connection to google cloud is probably to 104.198.46.246 which is our load balancer.

We have a graph here of incoming traffic from the device you mentioned (I’ll PM this to you for privacy reasons), and to us it all looks normal. We will keep monitoring though and see if we notice anything odd.

1 Like

Could you share what it was about? Thanks!

There isn’t any concrete explanation until’ I get a new switch that will allow me to set a port into monitor mode.

It is not uploading data to their cloud and I don’t have the hardware to further diagnose the issue right now.

The bulbs that I have don’t support AllJoyn as they are the 1100 model. I currently have these two bulbs powered off until’ I get better hardware so I can look further into it.

2 Likes