MozillaZine

FF / Midori / Chrome all calling the SAME home?

Discuss various technical topics not related to Mozilla.
Pat-The-Pirate
 
Posts: 5
Joined: August 22nd, 2016, 1:43 am

Post Posted August 22nd, 2016, 2:23 am

Hi

I noticed that my wifi dongle took to flashing its LED every couple of seconds a few weeks ago, and wondered why. I then discovered NETSTAT and to my amazement, I discovered in the space of 15 SECONDS, that my PC is "talking" to Google, Amazonaws to name but a few:

Active Connections

Proto Foreign Address State
TCP clients2.google.com:49213 ESTABLISHED
TCP clients2.google.com:49212 ESTABLISHED
TCP de-in-f157.1e100.net:https ESTABLISHED
TCP ec2-52-25-207-227.us-west-2.compute.amazonaws.com:https TIME_WAIT
TCP clients2.google.com:49213 ESTABLISHED
TCP clients2.google.com:49212 ESTABLISHED
TCP de-in-f157.1e100.net:https ESTABLISHED
TCP ec2-52-25-207-227.us-west-2.compute.amazonaws.com:https TIME_WAIT
TCP clients2.google.com:49213 ESTABLISHED
TCP clients2.google.com:49212 ESTABLISHED
TCP de-in-f157.1e100.net:https ESTABLISHED
TCP ec2-52-25-207-227.us-west-2.compute.amazonaws.com:https TIME_WAIT

I re-booted the PC to stop all the carry-on and to my FURTHER astonishment, discovered that Chrome and Midori browsers do exactly the same thing as FF.

I refer to a similar thread viewtopic.php?f=38&t=2932547 where ETcallHome got rather rough treatment for similarly asking why FF connects to websites such as AmazonAWS, Cloudfront, Akamai and other URLs that he/she didn't want to know about, and being loftily told that these connections are made on "our" behalf to allow such things as security updates, things to prevent phishing, and god-knows-what-else, and not to be bothering the Forum with his/her repeated requests for help.

I can understand the "occasional" connection for some specific purpose, but this sort of frenzied activity seems way more than a mere mortal like myself would deem necessary.

I would side with ET on this one. Who knows what information these browsers are pulling from my PC and sending on to these websites, which I have never knowingly contacted? and why do they need to keep in touch second-by-second?

Internet Explorer doesn't yield NETSTAT results other than anonymous ones, so it is a bit better, but again, you might "only" think you're talking to your favourite search engine but in reality there is a lot more going on beneath the surface.

So now I am no longer surprised when Facebook and Youtube suddenly put up adverts for topics I was momentarily interested in for a few seconds last week. And who owns these two? Oh, yes, . . . . .

I did discover an ancient browser called Arachne which doesn't have any bell or whistles. Maybe I'll become a real Luddite and go there.

:idea:

Grumpus

User avatar
 
Posts: 11592
Joined: October 19th, 2007, 4:23 am
Location: ... Da' Swamp

Post Posted August 22nd, 2016, 6:04 am

There's a couple of things which make the dongle go all blinky which are not the fault of AWS, Google or others.
Some of this can come from your ISP doing things like accounting of your time, checking the connection or verifying it's you.
However, you could look and make sure you haven't allowed something you should not have.
Check your Connections using edit and see whether you set "All users can connect to this network"
Does your dongle allow you to set whether IPV6 is on or off, do you really need it?
Some of the Google is for various things like anti-Phishing and other protective things which go on a regular basis.
Akamai is sometimes for site security and sometimes holds the site as a shield, blocking it could block the site.
If you can find a real time ip traffic monitor of some kind you can see exactly how much is being transferred back and and forth. (accounting)
Unfortunately Mozilla does regular add-on and plugin check-ups and uses AWS as do a great many villains.
Some of the Cloudfront can come from extensions. You can deal with some of the obnoxious JavaScript trafic by installing something like NoScript, uBlock, and others which limit traffic due to trackers and beacons.
If you see some traffic which is concerning, block the IP sub-net, or the specific IP or the url if that's the manner in which your systems blocks things.
But you have to be careful not to shut the door for something you need or want to view, this is where something like NoScript would com in.
You also do not have to allow cookies 100% of the time. You can close them off and only allow them when you visit a site which is important to you and necessary.
You might want to make sure your system is clean, malware, adware, etc.
Lastly none of this is intended to brush you aside it's just without having hands on there are a million things to guess at but unless the actual details are made available finding some problems take a bit more time as questions have to be asked and answered and in some cases the answers are less than what you look for.

Pat-The-Pirate
 
Posts: 5
Joined: August 22nd, 2016, 1:43 am

Post Posted August 22nd, 2016, 9:09 am

Hi Grumpus,

Thank you very much for a detailed reply, which I shall have to print out and tick off all the checks you suggest. You're right, the trouble is, stopping "something" happening usually causes some other bit of the web to complain. And then there are all the Windows Services, which I have no doubt have an interest in talking, at least, to my router.

I suppose, being a somewhat non-IT person, that what has happened is that I noticed a change in the blinkyness in the last while, and being naturally resistant to change (I always put my toothbrush in the same place), I tend to wish that whatever it was that happened would go away and stop pestering me.

I do recall downloading a program from a site around the time which did all sorts of advertising and pop-ups, and to my embarrassment I have forgotten what it was called. My browser history is similarly challenged, and I suspect that this was the cause of the problem. But why three browsers all connecting to the same websites? Could there be some Windows component they all pick up and run with?

The latest behaviour (and I am now perplexed) is that with the browser closed down, the PC is talking (I think) to mab.LIBRARY.UPENN.EDU:

TCP mab.LIBRARY.UPENN.EDU:http TIME_WAIT

which is not a website I have EVER visited.

To cut a long story short, I discovered “things” in my Windows Startup file, some of them down to Google, while others were items that installed software such as my soundcard application program stuffed in, and once I disabled all these, I was down to:

Active Connections

Proto Foreign Address State PID Offload State

TCP Owner-PC:0 LISTENING 728 InHost
TCP Owner-PC:0 LISTENING 4 InHost
TCP Owner-PC:0 LISTENING 432 InHost
TCP Owner-PC:0 LISTENING 812 InHost
TCP Owner-PC:0 LISTENING 928 InHost
TCP Owner-PC:0 LISTENING 476 InHost
TCP Owner-PC:0 LISTENING 520 InHost
TCP Owner-PC:0 LISTENING 4 InHost
TCP Owner-PC:0 LISTENING 728 InHost
TCP Owner-PC:0 LISTENING 4 InHost
TCP Owner-PC:0 LISTENING 432 InHost
TCP Owner-PC:0 LISTENING 812 InHost
TCP Owner-PC:0 LISTENING 928 InHost
TCP Owner-PC:0 LISTENING 476 InHost
TCP Owner-PC:0 LISTENING 520 InHost
UDP *:* 1132
UDP *:* 4
UDP *:* 4
UDP *:* 1132

I then checked Task Manager, and discovered that most of the PIDs belong to things that Windows 7 Services like to chat about.

That was as far as I really wanted to go.

So now I am happy that I have no control over anything else that goes on with my network connection, and hope not to get further Facebook suggestions about plane crash videos etc.

An interesting post-script is that once the browser has started to chat to Amazon, Cloudfront etc it carries on doing so EVEN AFTER the prowser has been closed off, and only stops when I re-boot.

*sigh*

Cheers

Grumpus

User avatar
 
Posts: 11592
Joined: October 19th, 2007, 4:23 am
Location: ... Da' Swamp

Post Posted August 22nd, 2016, 10:00 am

You may be leaving your wifi connection on, check to see if it's disabled or you've set it to "Airplane Mode".
Even as annoying as some of these transfers are if something is off they can't turn it on unless you maintain the connection

Lnwdz
 
Posts: 151
Joined: June 12th, 2012, 7:59 am

Post Posted August 22nd, 2016, 3:08 pm

I can mostly solve the mystery of traffic related to LIBRARY.UPENN.EDU. Firefox tries to prepare connections to domains you might visit soon. A signature in the current thread has a link to LIBRARY.UPENN.EDU. Firefox thinks you might click it.

Prefs to prevent such traffic (not tested recently):
network.dns.disablePrefetch = true
network.predictor.enabled = false

JayhawksRock

User avatar
 
Posts: 10429
Joined: October 24th, 2010, 8:51 am

Post Posted August 22nd, 2016, 3:34 pm

LIBRARY.UPENN.EDU also hosts a DNS server that you may be accessing somehow.
http://www.upenn.edu/computing/dns/settings.html
"The trouble with quotes on the internet is you never know if they are genuine" ...Abraham Lincoln

DanRaisch
Moderator

User avatar
 
Posts: 117680
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Post Posted August 22nd, 2016, 4:56 pm

Moving to MozillaZine Tech as this is not really a Firefox Support issue as other browsers show the same activity.

Pat-The-Pirate
 
Posts: 5
Joined: August 22nd, 2016, 1:43 am

Post Posted August 23rd, 2016, 2:39 am

I feel I am looking into a can of worms here. It's more than I am really capable of fixing, other than to pull the wifi dongle out of the PC when I've finished my web activity!

In concluding, I think it's a great pity that an independent organisation like Mozilla would make their browser any more complicated than (I think) it need be - paving the way to links I hadn't even realised existed, tends to wreck my head.

Incidentally, I noticed a typo above ("Prowser") - maybe a new word, combining "browser" and "prowler"?

Moderator, please close the thread if you feel you need to. At this stage I have no more to add, except to thank the contributors for helping me to understand the operation of crystal balls.

Pat-The-Pirate
 
Posts: 5
Joined: August 22nd, 2016, 1:43 am

Post Posted August 23rd, 2016, 10:04 am

PS Arachne is too outdated and difficult to install (for me). It used to be neat, only a few MB of code . . .

Frenzie

User avatar
 
Posts: 2104
Joined: May 5th, 2004, 10:40 am
Location: Belgium

Post Posted August 27th, 2016, 9:19 am

How about NetSurf? But I suspect you'll want something that works with a bit more of the modern web, no matter how annoying the modern web may be.
Intelligent alien life does exist, otherwise they would have contacted us.

Pat-The-Pirate
 
Posts: 5
Joined: August 22nd, 2016, 1:43 am

Post Posted August 31st, 2016, 4:47 am

Frenzie wrote:How about NetSurf? But I suspect you'll want something that works with a bit more of the modern web, no matter how annoying the modern web may be.
Frenzie,

I looked at Netsurf.org but can't see Windows mentioned. However, I'm wary of getting into discussion about browsers in general in this post because it was supposed to enquire about Firefox's doings in particular. If I were Mozilla I think I would take on board the concerns I raised initially about Firefox and go back to basics: IMHO a browser only needs to browse, not to be too clever.

But thanks for the suggestion. I think I'll use IE until I can figure out an alternative such as Netsurf.

Cheers

Return to MozillaZine Tech


Who is online

Users browsing this forum: Google [Bot] and 2 guests