Re: Ok, I've captured some traffic. Now what?

12.4.198.133 - www.crutchfield.com
174.129.88.133 - ec2-174-129-88-133.compute-1.amazonaws.com
174.37.113.144 - kaching.cacetech.com
204.9.177.195 - ??unknown??
204.9.178.11 - www.typepad.com
64.207.133.176 - skitch.com
64.215.158.100 - ??unknown??
64.215.158.101 - ??unknown??
64.215.158.102 - ??unknown??
64.215.158.103 - ??unknown??
64.215.158.108 - ??unknown??
64.215.158.109 - ??unknown??
64.215.158.111 - ??unknown??
64.215.158.116 - ??unknown??
64.215.158.117 - ??unknown??
64.215.158.94 - ??unknown??
64.215.158.95 - ??unknown??

I didn't do anything extensive to look those up, just nslookup/dig on my command-line.

So, that said....There's a couple of things you can do.

First, you could edit your (forgive me if it's not exact) c:\windows\system32\etc\hosts file to redirect any unknown-or-unwanted IP addresses to localhost, which is effectively making them go nowhere. Add lines to this etc\hosts file like so:

64.215.158.109 localhost
64.215.158.111 localhost

One IP address per line, redirecting to localhost. I cannot say for sure if you need to "only" restart your browser each time you edit the file, or if you "completely" need to reboot in order for this to be effective. It's obviously your choice, but you could either do 'em one-at-a-time to narrow down which one is the offending IP address, or you could add-em-all-at-once and see if that cures your ills in one swell foop. Note that it's recommended that you also make a backup (before and after editing) of this hosts file. Put it, say, on your Desktop. If, after rebooting, you still have issues and go back to look at this etc\hosts file and it's altered from the state you left it in, you'll know you have problems.

Post #329,754 by mvitale 7/17/10 10:18:05 AM 7/17/10 12:18:34 PM Reply	Re: Ok, I've captured some traffic. Now what? 12.4.198.133 - www.crutchfield.com 174.129.88.133 - ec2-174-129-88-133.compute-1.amazonaws.com 174.37.113.144 - kaching.cacetech.com 204.9.177.195 - ??unknown?? 204.9.178.11 - www.typepad.com 64.207.133.176 - skitch.com 64.215.158.100 - ??unknown?? 64.215.158.101 - ??unknown?? 64.215.158.102 - ??unknown?? 64.215.158.103 - ??unknown?? 64.215.158.108 - ??unknown?? 64.215.158.109 - ??unknown?? 64.215.158.111 - ??unknown?? 64.215.158.116 - ??unknown?? 64.215.158.117 - ??unknown?? 64.215.158.94 - ??unknown?? 64.215.158.95 - ??unknown?? I didn't do anything extensive to look those up, just nslookup/dig on my command-line. So, that said....There's a couple of things you can do. First, you could edit your (forgive me if it's not exact) c:\windows\system32\etc\hosts file to redirect any unknown-or-unwanted IP addresses to localhost, which is effectively making them go nowhere. Add lines to this etc\hosts file like so: 64.215.158.109 localhost 64.215.158.111 localhost One IP address per line, redirecting to localhost. I cannot say for sure if you need to "only" restart your browser each time you edit the file, or if you "completely" need to reboot in order for this to be effective. It's obviously your choice, but you could either do 'em one-at-a-time to narrow down which one is the offending IP address, or you could add-em-all-at-once and see if that cures your ills in one swell foop. Note that it's recommended that you also make a backup (before and after editing) of this hosts file. Put it, say, on your Desktop. If, after rebooting, you still have issues and go back to look at this etc\hosts file and it's altered from the state you left it in, you'll know you have problems. -Mike "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Benjamin Franklin, 1759 Historical Review of Pennsylvania Edited by mvitale July 17, 2010, 12:17:28 PM EDT Edited by mvitale July 17, 2010, 12:18:34 PM EDT Expand All History
Post #329,759 by Another Scott 7/17/10 11:43:36 AM Reply	Excellent. I should have rememberd that. Thanks.
Post #329,769 by folkert 7/17/10 2:20:16 PM Reply	Re: Excellent. I should have rememberd that. Thanks. doing a "wget" of the webserver on one of those IPs produces this: [Reference] Ref1=http://64.215.158.101/?MSWMExt=.asf Ref2=http://64.215.158.101:80/?MSWMExt=.asf I believe its a set of reflectors for a video stream. At least that is what it looks like to me. Porn site producers use them a lot... AS? What should we think now?
Post #329,771 by Another Scott 7/17/10 2:32:25 PM Reply	That shouldn't be it. ;-)
Post #329,796 by mvitale 7/17/10 10:03:33 PM Reply	Re: Excellent. I should have rememberd that. Thanks. Porn site producers use them a lot... AS? What should we think now? We should think that you know more about what porn sites do than AScott does. ;-) -Mike "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Benjamin Franklin, 1759 Historical Review of Pennsylvania
Post #329,806 by drook 7/18/10 9:22:33 AM Reply	Dang, beat me to it -- Drew

Welcome to IWETHEY!