BT keep accessing my router

Hi,

Having been a BT custimer for a number of years, I moved to PlusNet a couple of months ago. I continued to use my BT Homehub 3 without any problems. However, looking at the router logs for the last day or so, I can see the BT managment service is accessing my router every 5 minutes as shown below:

08:29:48,15 Jan. CWMP:session completed successfully
08:29:47,15 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE
08:24:48,15 Jan. CWMP:session completed successfully
08:24:47,15 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE
08:19:48,15 Jan. CWMP:session completed successfully
08:19:47,15 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE
08:14:47,15 Jan. CWMP:session completed successfully
08:14:47,15 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE
08:09:47,15 Jan. CWMP:session completed successfully
08:09:47,15 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE

Has anyone seen this behaviour before (and how can I stop it)?

I swapped to PlusNet a little earlier and am still using HH3. I am not seeing regular access, but am seeing some (see below).

More worrying, pbthdm.bt.mo does not appear to be BT ....
For wikipedia: .mo is the Internet country code top-level domain (ccTLD) for Macau. The registry for this domain name is operated by the Macao Network Information Centre (MONIC).
Unfortunately, the whois for Macau (https://www.monic.mo/monic/faces/whois) doesn't recognize that domain.



00:38:19,15 Jan. CWMP:HDM close the socket.
00:38:19,15 Jan. CWMP:session completed successfully
00:38:18,15 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 2 PERIODIC

00:38:18,14 Jan. CWMP:session completed successfully
00:38:17,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, X_BT-COM_SAAF PassiveValueChange
00:33:22,14 Jan. CWMP:Recv fault packets from HDM.
00:33:22,14 Jan. CWMP:session completed successfully
00:33:21,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, X_BT-COM_SAAF PassiveValueChange
00:31:14,14 Jan. CWMP:Recv fault packets from HDM.
00:31:14,14 Jan. CWMP:session completed successfully
00:31:13,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, X_BT-COM_SAAF PassiveValueChange
00:30:00,14 Jan. CWMP:Recv fault packets from HDM.
00:30:00,14 Jan. CWMP:session completed successfully
00:29:59,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, X_BT-COM_SAAF PassiveValueChange
00:29:28,14 Jan. CWMP:Recv fault packets from HDM.
00:29:27,14 Jan. CWMP:session completed successfully
00:29:27,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, X_BT-COM_SAAF PassiveValueChange
00:29:10,14 Jan. CWMP:Recv fault packets from HDM.
00:29:09,14 Jan. CWMP:session completed successfully
00:29:09,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, X_BT-COM_SAAF PassiveValueChange
00:29:02,14 Jan. CWMP:Recv fault packets from HDM.
00:29:01,14 Jan. CWMP:session completed successfully
00:29:01,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE
00:26:32,14 Jan. SAAF:Initialize TR69 Client Interface success.
00:25:32,14 Jan. CWMP:session completed successfully
00:25:32,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 6 CONNECTION REQUEST
00:25:26,14 Jan. CWMP:session completed successfully
00:25:25,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, 1 BOOT
00:25:16,14 Jan. CWMP:Recv fault packets from HDM.
00:25:16,14 Jan. HTTP Recv authorization success respond from:66.193.112.xx
00:25:15,14 Jan. HTTP Recv authorization failed respond from:66.193.112.xx
00:25:15,14 Jan. CWMP:session completed successfully
00:25:14,14 Jan. CWMP:session start now, server:https://pbthdm.bt.mo, Event code:, 4 VALUE CHANGE, 1 BOOT

https://community.bt.com/t5/BT-Infinity-Speed-Connec...

In reply to a post by stefan:

Has anyone seen this behaviour before (and how can I stop it)?

Get rid of the home hub. Its permanently looking for the "mother ship" of the BT network.

This TR-069 at work that many ISPs use to remotely configure their customers routers (to keep it working) - but you can't disable TR-069 in any of the Homehubs, as they don't provide any low level controls.

Remote management stops a lot of support calls - but if you're a technical type (probably as you're looking at logs) then you might want to consider running your own router, ASUS, TP-Link, TRENDnet all make great routers.

BT are not accessing your router. The router is looking for management and configuration information. Dialogues on CWMP are initiated by the CPE (which in the case of DSL is the customer end modem/router).

As for stopping it happening, I've no idea. However, given you are using a modem/router that was provided as part of a one ISP's service and using it on a different one, then it's maybe not surprising that it acts in what might appear unusual ways. Possibly there's a mismatch between what the HH3 is seeing on the Plusnet network and what the configuration server is presenting. As the config information is clearly bt specific, maybe there's an issue with the modem/router not being on a BT IP address. Possibly it's on a retry loop which will repeat for ever.

The obvious solution is to use a new router/modem. That way it can be configured as you wish.

Thanks - I don't think it is causing any problems (other than filling up the log files) but it might be time for a new router...

Thanks, I'm fairly technical, so setting up another router is no problem. I was just being a bit lazy and leaving the Homehub in place rather than configuring either the router supplied by Plusnet or another router.

BT have better things to do than access routers for no reason, trust me

In reply to a post by StephenTodd:

More worrying, pbthdm.bt.mo does not appear to be BT ....
For wikipedia: .mo is the Internet country code top-level domain (ccTLD) for Macau. The registry for this domain name is operated by the Macao Network Information Centre (MONIC).
Unfortunately, the whois for Macau (https://www.monic.mo/monic/faces/whois) doesn't recognize that domain.

I assume you are joking?

The domain name shown is truncated. The full one is pbthdm.bt.motive.com which is old name for the BT management interface at motive.com. The actual domain has been through some ownership changes so motive.com isn't current, but it really is the BT automated management portal.

That makes sense, but one aspect of your explanation puzzles me.

When you say "The actual domain has been through some ownership changes so motive.com isn't current, but it really is the BT automated management portal" to me that means (a) it no longer belongs to BT, and (b) it is no longer in use.

Re (a) I see it is owned by Alcatel-Lucent. That's fair enough, as it could quite easily have been outsourced to them by BT. But Re (b), if it isn't current, how come it is active and accessing the routers?