[145145] in North American Network Operators' Group
RE: facebook spying on us?
daemon@ATHENA.MIT.EDU (Erik Soosalu)
Thu Sep 29 09:36:44 2011
Date: Thu, 29 Sep 2011 09:34:38 -0400
In-Reply-To: <00413157-C15A-4F5A-9079-8BE6098E3559@inoc.net>
From: "Erik Soosalu" <erik.soosalu@calyxinc.com>
To: "Patrick Muldoon" <doon.bulk@inoc.net>, "Glen Kent" <glen.kent@gmail.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
At least on a win 7 box, netstat -b gives the process that initiated the
connection.
Likely opened due to a link or something from some other web page.
-----Original Message-----
From: Patrick Muldoon [mailto:doon.bulk@inoc.net]=20
Sent: Thursday, September 29, 2011 9:25 AM
To: Glen Kent
Cc: nanog@nanog.org
Subject: Re: facebook spying on us?
On Sep 29, 2011, at 9:13 AM, Glen Kent wrote:
> Hi,
>=20
> I see that i have multiple TCP sessions established with facebook.
> They come up even after i reboot my laptop and dont login to facebook!
>=20
> D:\Documents and Settings\gkent>netstat -a | more
>=20
> Active Connections
>=20
> Proto Local Address Foreign Address State
> TCP gkent:3974 www-10-02-snc5.facebook.com:http ESTABLISHED
> TCP gkent:3977 www-11-05-prn1.facebook.com:http ESTABLISHED
> TCP gkent:3665
> a184-84-111-139.deploy.akamaitechnologies.com:http ESTABLISHED
>=20
> [clipped]
>=20
> Any idea why these connections are established (with facebook and
> akamaitechnologies) and how i can kill them? Since my laptop has
> several connections open with facebook, what kind of information is
> flowing there?
>=20
Use a sniffer like wireshark, and see what the traffic is?=20
Are you using a chat program that supports facebook chat? Or perhaps a
game or an application that uses facebook for something? =20
Really it could be anything as there are lots of applications that have
grown up around the Facebook Eco system..=20
Also are you browsing the web? There are facebook like buttons and the
such all over the web. So you don't even need to be logged in or have
visited yet after the reboot.=20
> I also wonder about the kind of servers facebook must be having to be
> able to manage millions of TCP connections that must be terminating
> there.
Lots of them. There is video of their new DC floating around that shows
them..=20
http://www.datacenterknowledge.com/archives/2011/04/18/video-inside-face
books-server-room/
-Patrick
--
Patrick Muldoon
Network/Software Engineer
INOC (http://www.inoc.net)
PGPKEY (http://www.inoc.net/~doon)
Key ID: 0x370D752C
Base 8 is just like base 10, if you are missing two fingers. - Tom
Lehrer
