facebook spying on us?

Erik Soosalu erik.soosalu at calyxinc.com
Thu Sep 29 13:34:38 UTC 2011

At least on a win 7 box, netstat -b gives the process that initiated the

Likely opened due to a link or something from some other web page.

-----Original Message-----
From: Patrick Muldoon [mailto:doon.bulk at inoc.net] 
Sent: Thursday, September 29, 2011 9:25 AM
To: Glen Kent
Cc: nanog at nanog.org
Subject: Re: facebook spying on us?

On Sep 29, 2011, at 9:13 AM, Glen Kent wrote:

> Hi,
> I see that i have multiple TCP sessions established with facebook.
> They come up even after i reboot my laptop and dont login to facebook!
> D:\Documents and Settings\gkent>netstat -a | more
> Active Connections
>  Proto  Local Address          Foreign Address        State
>  TCP    gkent:3974    www-10-02-snc5.facebook.com:http  ESTABLISHED
>  TCP    gkent:3977    www-11-05-prn1.facebook.com:http  ESTABLISHED
>  TCP    gkent:3665
> a184-84-111-139.deploy.akamaitechnologies.com:http  ESTABLISHED
> [clipped]
> Any idea why these connections are established (with facebook and
> akamaitechnologies) and how i can kill them? Since my laptop has
> several connections open with facebook, what kind of information is
> flowing there?

Use a sniffer like wireshark, and see what the traffic is? 

Are you using a chat program that supports facebook chat?  Or perhaps a
game or an application  that uses facebook for something?  

Really it could be anything as there are lots of applications that have
grown up around the Facebook Eco system.. 

Also are you browsing the web?  There are facebook like buttons and the
such all over the web.  So you don't even need to be logged in or have
visited yet after the reboot. 

> I also wonder about the kind of servers facebook must be having to be
> able to manage millions of TCP connections that must be terminating
> there.

Lots of them.  There is video of their new DC floating around that shows



Patrick Muldoon
Network/Software Engineer
INOC (http://www.inoc.net)
PGPKEY (http://www.inoc.net/~doon)
Key ID: 0x370D752C

Base 8 is just like base 10, if you are missing two fingers.  - Tom

More information about the NANOG mailing list