deploy.akamaitechnologies.com and data it may be recieving

yabasta · 2010-05-18 12:56:50

hi upon visiting a website i like to frequent today ( cracked dot com) i noticed that i'd suddenly started uploading continuously at 60kb/s. I fired up netactview, and after a little investigation discovered that the culprit was a host called 'deploy.akamaitechnologies.com'. a little bit of googling leads me quite confused as to the nature of akamaitecnologies and what they do. are they legitimate or have they been hijacked i wonder?. This organisation seems to have a wealth of ip addresses etc at their disposal so i'm a bit at a loss as to how to block them with my firewall (ufw/gufw). more than anything i'd like to know what the data is that i'm sending them at 60kb/s from my pc, but, being not too linux savvy i don't really know how to go about this task. i'm using arch64 btw, openbox, ufw/gufw, midori browser.
when i enquired at the site's forum i was told 'It's one of the banner ads - been reported a couple of times. Shift+F5 a few times and you eventually rotate to an ad that doesn't do that.'

Sin.citadel · 2010-05-18 19:53:29

did u try using firefox with adblock? or is the uploading happening with all browsers?

yabasta · 2010-05-18 20:11:42

ive since been able to stop the uploading with an adblocking extension for midori. but still, is there any way for me to tell what data im sending if i repeat the process?

toxygen · 2010-05-18 20:17:46

akamai is (from my understanding) a huge data center/transport service provider, used by google, youtube, and nearly all bigger web presences.

when i was fiddling with blocking google from starting up with firefox (Why google Why?) akamai kept coming up on netstat, and i ended up blocking a bunch of akamai related hosts (akamai.net, akamaitech.net, etc). while this worked, albeit making some pages slower, google et all ended up just replacing akamai with another big host 1e100.net.

now doubleclick (owned by google) and other ad servers probably make heavy use of akamai and related hosts, so short of doing noscript/requestpolicy (addons for firefox) and hosts file blocking, you cant really avoid these hosts, so i'm with Sin.citadel and suggest blocking add-ons or other type of blocker software.

[edit] as far as what it's sending, it sounds suspicious to me. when it sends, do you see an ad running or some other activity? maybe try the command

netstat -aeoucptw

as root and follow along (the options on that keep netstat running and seeing what connections are made as they are made, it's hard to follow unless you open your terminal fullscreen) (and please experts if you have a shorter option to do this let us know). this should at least give you an idea of who is connecting and what it's connecting to.

Last edited by toxygen (2010-05-18 20:21:57)

Sjoden · 2010-05-18 20:20:55

Wireshark should be able to give you an idea. They're an ad network/content delivery network, they are probably gathering information like browsing habits etc. Running something like NOSCRIPT and not accepting cookies from any akamai domain should be able to help out, as those types of ads, or 'services', won't work without scripting and cookies.

Sjoden · 2010-05-18 20:22:29

toxygen wrote:

akamai is (from my understanding) a huge data center/transport service provider, used by google, youtube, and nearly all bigger web presences.
when i was fiddling with blocking google from starting up with firefox (Why google Why?) akamai kept coming up on netstat, and i ended up blocking a bunch of akamai related hosts (akamai.net, akamaitech.net, etc). while this worked, albeit making some pages slower, google et all ended up just replacing akamai with another big host 1e100.net.
now doubleclick (owned by google) and other ad servers probably make heavy use of akamai and related hosts, so short of doing noscript/requestpolicy (addons for firefox) and hosts file blocking, you cant really avoid these hosts, so i'm with Sin.citadel and suggest blocking add-ons or other type of blocker software.

I believe 1e100.net is Google.

toxygen · 2010-05-18 20:23:42

Sjoden wrote:

Wireshark should be able to give you an idea. They're an ad network/content delivery network, they are probably gathering information like browsing habits etc. Running something like NOSCRIPT and not accepting cookies from any akamai domain should be able to help out, as those types of ads, or 'services', won't work without scripting and cookies.

i agree. no script, no cookies, and request policy (which admittedly is a pain in the ass sometimes to use, but it really makes sure you are not letting *anything* you dont want coming in.

i like your sig-line Sjoden, it applies very well to google

toxygen · 2010-05-18 20:25:28

Sjoden wrote:

I believe 1e100.net is Google.

i dont doubt that, and akamai is probably inches away from being owned by google as well. on a (almost non)related note, those new android commercials for google are kind of creepy, google is turning into a weird monster... "see what android does.. see how much android owns you... you've never seen an android like this.. google owns you"

Sjoden · 2010-05-18 20:53:07

toxygen wrote:

Sjoden wrote:
Wireshark should be able to give you an idea. They're an ad network/content delivery network, they are probably gathering information like browsing habits etc. Running something like NOSCRIPT and not accepting cookies from any akamai domain should be able to help out, as those types of ads, or 'services', won't work without scripting and cookies.
i agree. no script, no cookies, and request policy (which admittedly is a pain in the ass sometimes to use, but it really makes sure you are not letting *anything* you dont want coming in.
i like your sig-line Sjoden, it applies very well to google

Thanks. I hadn't heard heard of request policy, i'll have to check it out

yabasta · 2010-05-18 21:34:54

thanks for the replies hmm, where to start. i tried reconnecting to cracked dotcom again whilst doing the netstat thing. as soon as i join this website i start constantly uploading at around 50/60 kb/s. tonight though, instead of akamaitechnologies that i was connecting to earlier, i'm (funnily enough) connecting to le100.net. lots and lots of connections. i guess if i want to find out the exact nature of the data that's streaming out of my pc is to install and learn wirehsark. how is this circumventing my firewall i wonder

Sjoden · 2010-05-19 00:33:27

how is this circumventing my firewall i wonder

It's probably just going over port 80 like the rest of the website. You really should install NOSCRIPT or else manage Javascript one way or another. Also disable cookies from third party websites. Most modern browsers will let you do those things, at least with plugins.

daniel.e.graham@gmail.com · 2012-08-13 01:38:28

While investigating a significant overage on my Verizon Mifi, I discovered the same thing. Used "trafshow", and I thought I saw it after I closed all browsers.

jasonwryan · 2012-08-13 07:28:17

Please don't necrobump: https://wiki.archlinux.org/index.php/Fo … Bumping.27

Closing

Arch Linux

#1 2010-05-18 12:56:50

deploy.akamaitechnologies.com and data it may be recieving

#2 2010-05-18 19:53:29

Re: deploy.akamaitechnologies.com and data it may be recieving

#3 2010-05-18 20:11:42

Re: deploy.akamaitechnologies.com and data it may be recieving

#4 2010-05-18 20:17:46

Re: deploy.akamaitechnologies.com and data it may be recieving

#5 2010-05-18 20:20:55

Re: deploy.akamaitechnologies.com and data it may be recieving

#6 2010-05-18 20:22:29

Re: deploy.akamaitechnologies.com and data it may be recieving

#7 2010-05-18 20:23:42

Re: deploy.akamaitechnologies.com and data it may be recieving

#8 2010-05-18 20:25:28

Re: deploy.akamaitechnologies.com and data it may be recieving

#9 2010-05-18 20:53:07

Re: deploy.akamaitechnologies.com and data it may be recieving

#10 2010-05-18 21:34:54

Re: deploy.akamaitechnologies.com and data it may be recieving

#11 2010-05-19 00:33:27

Re: deploy.akamaitechnologies.com and data it may be recieving

#12 2012-08-13 01:38:28

Re: deploy.akamaitechnologies.com and data it may be recieving

#13 2012-08-13 07:28:17

Re: deploy.akamaitechnologies.com and data it may be recieving

Board footer