Captive Portal background chatter

[Benjamin Markson]

https://www.mozilla.org/en-US/firefox/5 ... easenotes/

Added automatic captive portal detection which should improve access to WiFi hotspots. "When accessing the Internet via a captive portal, Firefox will alert users and open the portal login page in a new tab.

So, some new gimmick - not particularly easy to find any straight forward description of this but something to do with WiFi hotspots. Exactly the sort of thing we all need as we roam the streets with our desktop computers.

Anyway, it comes with some random background chatter where FF52 continually poles: http://detectportal.firefox.com/success.txt

network.captive-portal-service.enabled -> false to switch it off.

Cheers,
Ben.

[Grumpus]

The chatter may be coming from search guide.
Right after I hit the detect portal link, even though it's already set to false in 51 as default it started.
I got a page which had nothing but the word success on it.
It could have been the "not found" server for search guide but it's definitely annoying ate about 3 MB before it was stopped.
198.105.254.0/24 is the subnet to block
They really need to declare Search Guide as malware and block them.

[Benjamin Markson]

The chatter may be coming from search guide.

I don't know what you mean by search guide. The chatter I am referring to is coming from Firefox, even when it is idle, when the captive portal service is enabled. I use Wireshark to monitor this.

...hit the detect portal link

I don't know where that is.

I got a page which had nothing but the word success on it.

That sounds like: http://detectportal.firefox.com/success.txt

198.105.254.0/24 is the subnet to block

Google tells me that this belongs to Search Guide Inc. As far as I can tell this appears to be some kind of redirect service used by some (US?) ISPs to hijack URLs that don't resolve to an IP address. I would suggest that anyone in this situation configure their computer to use an alternative DNS provider and not the one provided by their ISP.

You can use this tool to optimise DNS lookups: https://www.grc.com/dns/benchmark.htm - it will also tell you how 'honest' the nameserver is (ie. “Redirecting” nameservers are those that do not return errors when asked to lookup an invalid domain name. Instead, they redirect a web browser to another, often commercial marketing, page.)

I don't think this has anything to do with captive portal detection.

Ben.

[Grumpus]

I think you're right on all counts.
Is the chatter coming from AWS ips assigned to Mozilla?
When I clicked on the link you supplied http://detectportal.firefox.com/success.txt I got the simple text page success.
As to the search guide I believe it was a result of clicking on that link somehow triggered a redirect which set off the search guide.
Unfortunately the GRC link and product will not help me as it requires Wine installed.
I've tried Wine and removed it due to what it loaded on the system, I just block the search guide ips when found.
Thanks anyway.