the explaination of a experiment on ****yet***** Another new Google twist..

[David Farber <dave () farber net>]

Begin forwarded message:

From: Harsha V Madhyastha <harsha () cs washington edu>
Date: January 9, 2006 8:59:35 PM EST
To: dave () farber net
Subject: Re: [IP] more on ****yet***** Another new Google twist..

Dave,

Here is a brief explanation of the experiment that Google is carrying  
out. This was recently posted to the PlanetLab support mailing list  
by one of the members involved in this research.

==================================================

Dear Jon,

it seems that your firewall is logging packets that are triggered by a
research experiment that I am involved in. It is being run by Google,  
and aims at measuring latencies to a small random fraction of Google  
clients.

The experiment is completely harmless: it only causes some Google  
clients to retrieve small pieces of content from Web servers running  
on port 81 of selected PlanetLab nodes. These content pieces are  
retrieved using HTTP connections that your firewall is logging. You  
notice 6 entries per connection because your firewall is logging  
every single packet that belongs to that connection, and there are  
apparently 6 such packets. The latencies to Google clients are  
estimated by the Web servers running on PlanetLab nodes based on the  
dynamics of packets forming the HTTP connections.

I am sorry for the inconvenience that this experiment might have  
caused to you. I must also tell you that you are extremely lucky to  
have been
selected to participate in the experiment twice within 5 minutes, as  
it is extremely unlikely to happen.

Finally, given that retrieving small additional content from PlanetLab
nodes is perfectly safe, you can simply ignore the log entries  
produced by your firewall. However, should you decide to allow the  
additional HTTP connections to be opened, you will be helping in an  
exciting research experiment, for which I would be extremely  
grateful. I am also ready to answer any further questions you might  
have about this experiment.

Best regards,
Michal Szymaniak


>> Thu Jan 05 05:43:45 2006: Request 12581 was acted upon.
>> Transaction: Ticket created by jds () generalmail com
>>
>> Subject: Odd firewall traffic
>>
>> Sorry for the interruption! I hope you can help me. I'm perplexed  
by this:
>>
>> Jan  5 14:28:42 localhost kernel: jds-FW: IN= OUT=eth0  
SRC=192.168.0.3
>> DST=128.101.191.245 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=31804 DF  
PROTO=TCP
>> SPT=33139 DPT=81 WINDOW=5808 RES=0x00 SYN URGP=0
>>
>> Jan  5 14:32:17 localhost kernel: jds-FW: IN= OUT=eth0  
SRC=192.168.0.3
>> DST=164.164.104.163 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=7594 DF  
PROTO=TCP
>> SPT=52904 DPT=81 WINDOW=5808 RES=0x00 SYN URGP=0
>>
>> As you can see it's coming from inside my firewall. I have a home
>> router/firewall. This source (192.168.0.3) is my laptop which is  
running Debian
>> 3.1. It has been behind the router/firewall since I installed it.  
I recently
>> stared learning about the iptables firewall and have a default  
DROP policy.
>> That's why I'm getting these logged. When these get logged they  
seem to log 6
>> hits at a time all on the same SPT and DPT and always to these  
two URL's which
>> led me to you. I don't know that I have ever visited a coralized  
link as your
>> site states. Either way I'm perplexed how and why this traffic is  
trying to go
>> out from my laptop, and what it is trying to send out. I'm also  
wondering how to
>> stop it other than adding another rule to DROP them before they  
get logged.
>>
>> Any help would be welcome!
>> Jon
>>
>> _______________________________________________
>> PlanetLab Support Mail Reflector
>> support () planet-lab org
>> https://lists.planet-lab.org/mailman/listinfo/support-community
>>


_______________________________________________
PlanetLab Support Mail Reflector
support () planet-lab org
https://lists.planet-lab.org/mailman/listinfo/support-community

David Farber wrote:
> Begin forwarded message:
> From: Rodney Joffe <rjoffe () centergate com>
> Date: January 9, 2006 6:11:13 PM EST
> To: Lauren Weinstein <lauren () vortex com>, Dave Farber  
> <dave () farber net>
> Subject: Re: [IP] more on Another new Google twist..
> Hi Lauren,
> On Jan 9, 2006, at 1:36 PM, David Farber wrote:
> > Begin forwarded message:
> >
> > From: Lauren Weinstein <lauren () vortex com>
> > Date: January 9, 2006 2:41:01 PM EST
> > To: dave () farber net
> > Cc: capek () ieee net
> > Subject: Re: [IP] Another new Google twist..
> >
> > This is not entirely a straightforward situation.  First, such
> > history displays are almost certainly based on cookies, so persons
> > who do not allow Google cookies are unlikely to see such output.
> > (Note however that this is a separate issue from Google's internal
> > logs of user search activity presumably tied to IP addresses.)
> But wait, there's more. I have also been noticing seemingly random   
> but frequent attempts to trigger firefox connections to various   
> planetlabs machines (http://www.planet-lab.org/) as a result of   
> Google searches. I think it is admirable that Google is supporting   
> the research world but were it not for my "littleSnitch"  
> application,  I would have had no idea. Nor do I know what Google  
> is triggering, or  what data is being forwarded to the planetlabs  
> network, or why - I  haven't bothered to stop it thus far. Have you  
> noticed this?  "Googling" for this brings up general hints showing  
> Google's  involvement, but I can't find any official note in  
> Google's help  pages or FAQ.
> Machines include:
> Server: planet3.seattle.intel-research.net (12.17.136.138)
> Server: planetlab2.ls.fi.upm.es (138.100.12.149)
> Server: planetlab2.eecs.umich.edu (141.213.4.202)
> Server: planetlab1.pop-rs.rnp.br (200.132.0.69)
> Server: planetlab1.pop-rs.rnp.br (200.132.0.70)
> ----------------------------------------------
> Rodney Joffe
> CenterGate Research Group, LLC.
> http://www.centergate.com
> "Technology so advanced, even we don't understand it!"(R)
> -------------------------------------
> You are subscribed as harsha () cs washington edu
> To manage your subscription, go to
>  http://v2.listbox.com/member/?listname=ip
> Archives at: http://www.interesting-people.org/archives/interesting- 
> people/

--
------------------------------------------------------------------------ 
---
University of Washington | http://www.cs.washington.edu/homes/harsha
harsha () cs washington edu | http://harshaandsports.blogspot.com
------------------------------------------------------------------------ 
---


-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/