WANTED: Verbose wordy advanced technical explaination...

[jackthechemist]

Hello all,

I'm running Firestarter (a simple graphical front-end to iptables) on Ubuntu.

When I open Firefox (homepage is still the default http://start.ubuntu.com/9.10/) Firestarter shows the following two connections:

C1
Dest: 91.189.90.40 Host: avocado.canonical.com Port: 80

C2
Dest: 209.85.225.147 Host: iy-in-f147.1e100.net Port: 80

And after about 15 seconds of starting at my homepage two more appear:

C3
Dest: 209.85.225.190 Host: iy-in-f190.1e100.net Port: 443

C4
Dest: 209.85.225.138 Host:iy-in-f138.1e100.net Port: 80

Then after about 45 seconds the the first two terminate.

If anyone out there can give me an advanced verbose wordy highly technical explanation of why this all happens I would we very grateful. If you can explain this without using metaphors or analogies even better!

I've tested this several times. Sometimes the low level domains (the 'avacado' and 'iy-in-fxxx' parts in my example above) change but all else is generally the same. I've also noticed that other websites will often cause 6+ active connections to appear!

My guess is that the different parts of the webpage are coming from different servers, thus the various connections...

Thanks in advance!

Jack

[Tony]

jackthechemist @ Tue Jun 01, 2010 9:36 pm wrote:

I've also noticed that other websites will often cause 6+ active connections to appear!

A browser makes a new request for each resource on the page -- CSS files, JavaScript files, images, etc. I think, by default, Firefox will make up to 4 (it might be a different number though) parallel requests per subdomain. A trick to speed up page-load times (by allowing a browser to make more parallel connections) is to have multiple subdomains for hosting static assets.

[[Gandalf]]

You can experiment with the above by going to about:config in Firefox, and searching up pipelining. Is network.http.pipelining enabled? What is your network.http.pipelining.maxrequests value, and what happens when you lower it to, say, 1?

[jackthechemist]

Thanks for the replies.

I've managed to gather that a single website allows multiple connections so that separate page resources can be downloaded via individual channels, but what I would like to know is:

1) How to I know which host is sending me which resource? Knowing who the 1e100 domain belongs to does not inform me of its exact purpose. What am I downloading from it? Is it javascript? css? something else?

2) I would like to configure my firewall to include the specific resource I'm getting from each host and to color code each active connection according to the webpage they belong to. I think I could handle the GUI programming but how can I find this information? A whois lookup doesn't tell me what I need to know :\ I hope packet sniffing is NOT the only answer, I would prefer to conserve my resources.

???

[thegadgetman]

Try using something called a packet sniffer might give you the details your looking for.
http://sectools.org/sniffers.html