Member Avatar for jackthechemist

Hello all,

I'm running Firestarter (a simple graphical front-end to iptables) on Ubuntu.

When I open Firefox (homepage is still the default http://start.ubuntu.com/9.10/) Firestarter shows the following two connections:

C1
Dest: Host: Port: 80

C2
Dest: Host: Port: 80

And after about 15 seconds of starting at my homepage two more appear:

C3
Dest: Host: Port: 443

C4
Dest: Host: Port: 80

Then after about 45 seconds the the first two terminate.

If anyone out there can give me an advanced verbose wordy highly technical explanation of why this all happens I would we very grateful. If you can explain this without using metaphors or analogies even better!

I've tested this several times. Sometimes the low level domains (the 'avacado' and 'iy-in-fxxx' parts in my example above) change but all else is generally the same. I've also noticed that other websites will often cause 6+ active connections to appear!

My guess is that the different parts of the webpage are coming from different servers, thus the various connections...

Thanks in advance!

Jack

  • 2 Contributors
  • 3 Replies
  • 95 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by sknake

Dani AI

Generated

Brief technical summary for (and expanding on ): a browser loads the HTML, parses it, and issues a separate HTTP(S) request for each referenced resource (images, CSS, scripts, XHR/fetches, fonts, etc.). Requests to different hostnames often require separate TCP/TLS sessions, browsers open several socket pairs in parallel for latency hiding and throughput, and modern features (DNS prefetch / preconnect, CDNs, async scripts) add extra short-lived connections. HTTP/2 can multiplex many logical requests over one TCP connection to a single host, but that only reduces TCP count when the remote supports HTTP/2; TLS encrypts request paths so a packet-level firewall cannot see full URLs without TLS interception (SNI reveals only the server name).

Practical, non-DPI ways to map socket → resource: the browser’s Network panel already shows the full request URL, resource type, timing and the remote address; correlate those timestamps/IPs with what the firewall reports. Typical, low-effort workflow: capture the page load in DevTools (Network), inspect a request’s Headers (Host/Request-URI and Remote address), then match IP + timestamp to the firewall entry. See Firefox/Chrome DevTools for details: Firefox Network Monitor and Chrome DevTools Network panel.

If a per-firewall, persistent mapping or color-coded dashboard is required, run a local HTTP(S) proxy that logs requests (transparent proxying or an explicit browser proxy). An intercepting proxy (for HTTPS) must present a trusted CA to the browser to see request URIs; that is the practical alternative to deep packet inspection. Tools like mitmproxy can log, tag and export requests for downstream visualization or scripts.

Caveats: correlating at the firewall level without decrypting TLS cannot reveal URL paths; short-lived connections often reflect keep‑alive timeouts, preconnects, or script-created fetches rather than persistent transfers. For occasional inspection use DevTools; for continuous monitoring use a proxy + logging/visualization.

Recommended Answers

All 3 Replies

Member Avatar for sknake

>>My guess is that the different parts of the webpage are coming from different servers, thus the various connections...

You are correct... not much else to add. When you visit a webpage, say cnn.com, it could reference images from or imageshack.com. There are also websites that run trash javascript that connect to other servers. One example is a javascript that waits for you to highlight text with your cursor. As soon as you highlight the text it posts to a server recording your IP and the text you highlighted. In theory they are "catching people who are copying and pasting content from their website". In practice they are pissing off users who highlight text as they read (me).

Member Avatar for jackthechemist

Thanks! Actually, I didn't know that was possible with javascript. Even so, I would like to configure my firewall to do two things:

1) Display more information about hosts to which I have an active connection, namely, what resource I'm downloading from them. e.g. say I connect to fuzzypotatoes.com and 5 active connections are initiated. I want my firewall to say which one I'm getting javascript from, which I'm getting css from etc.

2) I'd like to have my firewall color code the active connections according to the website their initiated by. (this one is easy of course :P just thought I'd include it hear anyways)

So is there anyway to do this easily? i.e. ideally without packet sniffing? I'd prefer to conserver resources. A whois lookup doesn't get me the info I need. If I open a webpage, there MUST be an EASY way to monitor the consequent connections, and determine which resource each one is retrieving.

Any ideas???

Member Avatar for sknake

This is actually going to be very difficult...

This is called "deep packet inspection" because you need to gather packet fragments, reassemble them in to complete conversations, parse the packets for HTTP header values so you can determine the content type, URL and resource type.

This is not going to be easy to roll your own solution.

Also -- what type of firewall are you running?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.