On Tue, Oct 22, 2013 at 02:19:00AM +0200, Stefan Wollny wrote: > Hi there! > > In the last days I had an interesting and educational thread here on > misc@ on how to block facebook.com. > > Knowing that many of the OpenBSD-pros on this list are way more > educated on network-related issues than I am, I hope none feels > offended with another question related to Facebook: > > Today I am once more off-site from home, but with access to an iMac > running OpenBSD-amd64/current; PF runs out-of-the-box unchanged. I > noticed that ping responses for 'facebook.com' are exceptionally faster > than e.g. those for 'google.com'. This is what I did to track down on > the issue: > > ++++++++++++++++++++++++++++++++ > $ cat /etc/resolv.conf > # Generated by nfe0 dhclient > nameserver 192.168.1.1 > lookup file bind > > $ cat /etc/hosts | grep facebook > 127.0.0.1 facebook.com > 127.0.0.1 www.facebook.com > 127.0.0.1 facebook.de > 127.0.0.1 www.facebook.de > 127.0.0.1 de-de.facebook.com > 127.0.0.1 ads.ak.facebook.com > 127.0.0.1 creative.ak.facebook.com > 127.0.0.1 facebookinc.122.2o7.net > > $ sudo traceroute google.com > 1 netgear (192.168.1.1) 0.301 ms 0.232 ms 0.228 ms > 2 aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 9.933 ms 7.890 ms 11.456 ms > 3 ve-cmts.mes-muc-02.de.infra.cablesurf.de (aaa.bbb.ccc.ddd) 9.556 > ms 12.199 ms 9.277 ms > 4 aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 20.649 ms 22.526 ms 17.204 ms > 5 google.bcix.de (aaa.bbb.ccc.ddd) 22.794 ms 23.894 ms 26.117 ms > 6 aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 22.263 ms aaa.bbb.ccc.ddd > (aaa.bbb.ccc.ddd) 22.457 ms aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 21.597 > ms > 7 aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 26.983 ms aaa.bbb.ccc.ddd > (aaa.bbb.ccc.ddd) 25.247 ms aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 35.177 > ms > 8 aaa.bbb.ccc.ddd (aaa.bbb.ccc.ddd) 20.533 ms aaa.bbb.ccc.ddd > (aaa.bbb.ccc.ddd) 22.67 ms 21.929 ms > 9 * * * > 10 bk-in-f100.1e100.net > (aaa.bbb.ccc.ddd) 21.421 ms 23.498 ms 21.952 ms > > $ sudo traceroute facebook.com > 1 localhost (127.0.0.1) 0.57 ms 0.23 ms 0.19 ms > > $ pkg_info | grep proxy > libproxy-0.4.11p3 library handling all the details of proxy > configuration libproxy-mozilla-0.4.11p2 pacrunner libproxy plugin for > mozilla-based (gecko) browsers > > $ man libproxy > man: no entry for libproxy in the manual. > > $ apropos libproxy > libproxy: nothing appropriate > ++++++++++++++++++++++++++++++++ > > I'd like to mention that I am in the outskirts of Munich and that the > system was freshly started into a console (no X, no browser). The > netgear-router at 192.168.1.1 also serves a colleague who uses facebook. > > MY QUESTION: What might have happened that 'facebook.com' is found on > localhost at 127.0.0.1 on my machine? Actually 'google.com' is called > regularly thus I'd expeced it to be as fast/show as 'facebook.com'. I > have no clue and I don't have the slightest idea on how to get rid of > this address - can anyone provide some more insight? Other information > you need to provide advice? > > Thank you! > > Kind regards > > STEFAN
The loopback IP 127.0.0.1 is your computer, so of course the ping response is faster than google.com. Unless you have some proxy web server running on your computer, you shouldn't be able to access facebook.com. Of course, if your web browser uses a different DNS resolver or the system resolver is configured to ignore /etc/hosts, it may ignore /etc/hosts and you could navigate to the facebook.com webpage. Can you view the page? The netgear router and your colleague are irrelevant if these settings are on your local computer. As to your question, facebook.com is found on localhost because your set it so in /etc/hosts. If you can still navigate to the webpage, watch your outgoing traffic with tcpdump, and I'm sure you will see connections to their web servers. The frequency with which you access a service and the speed at which you can access it are of course completely unrelated. I'm not sure what you're asking there. - Martin
