Why is Firefox continuously accessing the Internet?

[Renny Bosch]

I have a little Network Activity Indicator icon in the Taskbar, and
(almost) whenever Firefox is open, it shows nearly continuous Internet
access. This is not the case when IE is open. What is Firefox doing?
Is it prereading all possible links? Or is this an indication of some
malware?

Windows 7 x64 fully updated, Firefox 20, IE 10.

 

[Paul in Houston TX]

I have a little Network Activity Indicator icon in the Taskbar, and
(almost) whenever Firefox is open, it shows nearly continuous Internet
access. This is not the case when IE is open. What is Firefox doing?
Is it prereading all possible links? Or is this an indication of some
malware?

Windows 7 x64 fully updated, Firefox 20, IE 10.

Do you have homepage set for about: or about:blank ?
Where are the packets going to / coming from?
What does your hardware firewall show?
Is mail open at the same time?
Any push stuff open?
It could be doing a loopback. Check your hardware firewall
or packet monitor to find out.

 

[Paul]

I have a little Network Activity Indicator icon in the Taskbar, and
(almost) whenever Firefox is open, it shows nearly continuous Internet
access. This is not the case when IE is open. What is Firefox doing?
Is it prereading all possible links? Or is this an indication of some
malware?

Windows 7 x64 fully updated, Firefox 20, IE 10.

Install Wireshark, log the packets ?

http://en.wikipedia.org/wiki/Wireshark

In View : Name Resolution, tick all the items.
Use Capture : Interfaces to select your NIC. Then
trace and see what is happening.

If you can't get Wireshark to work properly, the PCAP
thing has to run elevated to access hardware. (Wireshark
consists of a capture application and a viewer application,
and the capture accesses hardware to do promiscuous mode
NIC stuff.) If you're having a problem, that could be why.
I had to screw around with it a bit, to get it working
on Windows 8 for example.

*******

http://en.wikipedia.org/wiki/Mozilla_Foundation

"The majority of the revenues comes from Google Inc., which
is the default search engine on Mozilla Firefox."

So that gives you some idea who they are affiliated with.

In Options, there used to be a "tell me if I'm visiting
a known attack site". I think the database for that, updates
in the background. If you keep Firefox open and idle, it
may download new data for that database in the background.
That's why you'd use the packet sniffer, to see what it's doing.
While there is a way to list TCP connections in a command
prompt window, capturing all the packets is a more complete
record.

In the article here, they suggest Sysinternals TCPView.

http://web.archive.org/web/20090116172018/http://windowsxp.mvps.org/netstat.htm

You can get your copy of TCPView here, saving you from
having to run netstat or the like. Sysinternals was bought
by Microsoft, which is why they're hosted there.

http://technet.microsoft.com/en-us/sysinternals/bb897437

TCPView just shows connection status, rather than being
an actual packet tracer. It should show an entry for
whatever Firefox is pinging at the moment.

Paul

 

[s|b]

I have a little Network Activity Indicator icon in the Taskbar, and
(almost) whenever Firefox is open, it shows nearly continuous Internet
access. This is not the case when IE is open. What is Firefox doing?
Is it prereading all possible links? Or is this an indication of some
malware?

Windows 7 x64 fully updated, Firefox 20, IE 10.

I can't say for sure, but I would guess it has something to do with
automatic updates. Not only for Fx itself, but also for add-ons. AFAIK
IE doesn't do automatic updates. It needs Windows Updates to update.

If you _really want to know, ask your question in
mozilla.support.firefox through news.mozilla.org (no login or password
needed).

 

[Paul]

OK, I fired up Windows 8, which has Firefox 19 in it, and
it auto-updated itself to 20.0.1 . (That's like, a 20MB download.)
Upon restarting the Firefox application, then leaving it sit idle,
I saw *no* packet traffic from Firefox.

Now that doesn't mean a network indicator wouldn't flash
or not. It all depends on how the network indicator works
as to what it is triggered from. But using a packet sniffer,
I didn't see any traffic leaving the computer with Firefox
left idle. I didn't run it for "hours and hours" though,
which would be necessary for a real test. There is plenty
of maintenance-type activity on modern computers, and you'd
really need to leave it running for 24 hours to catch
a portion of it.

Paul

 

[John Williamson]

I have a little Network Activity Indicator icon in the Taskbar, and
(almost) whenever Firefox is open, it shows nearly continuous Internet
access. This is not the case when IE is open. What is Firefox doing?
Is it prereading all possible links? Or is this an indication of some
malware?

Windows 7 x64 fully updated, Firefox 20, IE 10.

In Forefox, open Tools, Options, Advanced, Data Choices.

Is the telemetry box ticked? It's an option that they've created which
constantly sends back info about the connection and other stuff to Mozilla.

From their website privacy policy:-

"Usage Statistics (also known as Telemetry). Beginning with version 7,
Firefox includes functionality that sends Mozilla usage, performance,
and responsiveness statistics about user interface features, memory,
hardware configuration along with IP address.

This feature is turned off by default in general release versions of
Firefox and Firefox Beta. In order to enable Aurora and Nightly testers
to provide more efficient feedback, Usage Statistics are enabled by
default on Aurora and Nightly. In either case, if this functionality is
enabled, users can disable it in Firefox's Options/Preferences by simply
deselecting the "Submit performance data" item.

Usage statistics are transmitted using SSL (a method of protecting data
in transit) and help us improve future versions of Firefox. Once sent to
Mozilla, usage statistics are stored in an aggregate form and made
available to a broad range of developers, including both Mozilla
employees and public contributors."

 

[Paul]

I have a little Network Activity Indicator icon in the Taskbar, and
(almost) whenever Firefox is open, it shows nearly continuous Internet
access. This is not the case when IE is open. What is Firefox doing?
Is it prereading all possible links? Or is this an indication of some
malware?

Windows 7 x64 fully updated, Firefox 20, IE 10.

I thought you might get a kick out of this article

http://arstechnica.com/information-...nments-poses-as-firefox-and-mozilla-is-angry/

The FTP site has checksums. To help you check
whether (official) Firefox is legit.

ftp://ftp.mozilla.org/pub/firefox/releases/20.0.1/

Paul

 

[Renny Bosch]

Do you have homepage set for about: or about:blank ?
Where are the packets going to / coming from?
What does your hardware firewall show?
Is mail open at the same time?
Any push stuff open?
It could be doing a loopback. Check your hardware firewall
or packet monitor to find out.

I'm sorry I left out this important information. My home page is
about:blank, and when Firefox is sitting on that there is no network
activity. In fact the amount of activity seems to be related to the
amount of clickable links in the page that is open. For instance when I
am looking at Google News
(https://news.google.com/nwshp?tab=wn&ie=UTF-8&rls=GGGL,GGGL:2006-12,GGGL:en)
the Activity indicator blinks with a duty cycle of about 50%. This goes
on for maybe 5 minutes, after which it stops. If I am looking at a page
that has no ads, the activity goes silent after just a minute or so.

As far as I know I never have any push stuff open, though of course
Google News automatically checks for new content every 5 minutes or so.

Firewall is Microsoft's and reports no anomalies.

I use Google Mail so that's just another page I might be looking at with
Firefox, and it does show long network activity.

 

[Daniel47]

I'm sorry I left out this important information. My home page is
about:blank, and when Firefox is sitting on that there is no network
activity. In fact the amount of activity seems to be related to the
amount of clickable links in the page that is open. For instance when I
am looking at Google News
(https://news.google.com/nwshp?tab=wn&ie=UTF-8&rls=GGGL,GGGL:2006-12,GGGL:en)
the Activity indicator blinks with a duty cycle of about 50%. This goes
on for maybe 5 minutes, after which it stops. If I am looking at a page
that has no ads, the activity goes silent after just a minute or so.

As far as I know I never have any push stuff open, though of course
Google News automatically checks for new content every 5 minutes or so.

Firewall is Microsoft's and reports no anomalies.

I use Google Mail so that's just another page I might be looking at with
Firefox, and it does show long network activity.

Renny, Firefox is based on the browser portion of Mozilla Suite, and my
SeaMonkey Suite is based on the entire Mozilla Suite!

One of the abilities of SeaMonkey browser is to "pre-fetch" information
on the links in a web-page, so that if I click on any of the links, they
load quicker.

As FF is based on similar code, I expect it has a similar ability, so
have a look at your settings, which, I think are under Tools->Options or
similar.

(Of course, now that I look for it in my season preferences, I cannot
find this setting!!)

Daniel

 

[Paul in Houston TX]

I'm sorry I left out this important information. My home page is
about:blank, and when Firefox is sitting on that there is no network
activity. In fact the amount of activity seems to be related to the
amount of clickable links in the page that is open. For instance when I
am looking at Google News
(https://news.google.com/nwshp?tab=wn&ie=UTF-8&rls=GGGL,GGGL:2006-12,GGGL:en)
the Activity indicator blinks with a duty cycle of about 50%. This goes
on for maybe 5 minutes, after which it stops. If I am looking at a page
that has no ads, the activity goes silent after just a minute or so.

As far as I know I never have any push stuff open, though of course
Google News automatically checks for new content every 5 minutes or so.

Firewall is Microsoft's and reports no anomalies.

I use Google Mail so that's just another page I might be looking at with
Firefox, and it does show long network activity.

Sounds pretty normal to me. IE does the same with Google news.
Google news must have about 500 links per page and many of them
are loading themselves along with tons of tracking cookies.
And as Dan47 said, Mozilla has pre-fetch.

 

[Mark12547]

One of the abilities of SeaMonkey browser is to "pre-fetch" information
on the links in a web-page, so that if I click on any of the links, they
load quicker.

As FF is based on similar code, I expect it has a similar ability, so
have a look at your settings, which, I think are under Tools->Options or
similar.

There isn't a menu choice for Prefetch in Firefox, but there are
optional settings in about:config (type about:config in the address bar
of Firefox).

The defaults are:

network.dns.disablePrefetch boolean false
network.prefetch-next boolean true


network.dns.disablePrefetch:
When false (the default), after a page is loaded, once Firefox is
"idle", Firefox will perform DNS lookups for references on the current
page so the loading of the next page clicked on will go faster since
some of the DNS entries needed for the next page would have already been
resolved. DNS entries are small as far as network traffic goes.

see https://developer.mozilla.org/en-US/docs/Controlling_DNS_prefetching

network.prefetch-next:
When true (the default), directives coded in the HTML to prefetch
objects for the next page(es) displayed. When Firefox is "idle", Netflix
will start fetching those objects. In some cases, this could include
objects from multiple pages. This could put more load on the network.

see http://kb.mozillazine.org/Network.prefetch-next
see https://developer.mozilla.org/en-US/docs/Link_prefetching_FAQ


Other activity that might keep the Internet connection in use would
include auto-reloading pages, and "rich content" that keeps on changing
(such as a video or sound file).

Some add-ins to Firefox may also be doing web checks. For example, with
Web Of Trust installed, a Google Search page or Google Images search is
littered with WOT circles, the color being a quick indication of site
trustworthiness (based mostly on other WOT user scores of that site) and
hovering the mouse over the WOT circle will display a brief score card
for that site. A page with lots of links would require a lot of
interaction with the WOT site and I don't know if the score cards are
downloaded ASAP or are fetched in background if not immediately needed.

A "cloud-based" virus checker may also be communicating with its "home"
to check objects in the current web page.

And a whole lot of programs will periodically check for updates and
download them, including Firefox itself and some add-ins.

 

[Daniel47]

There isn't a menu choice for Prefetch in Firefox, but there are
optional settings in about:config (type about:config in the address bar
of Firefox).

The defaults are:

network.dns.disablePrefetch boolean false
network.prefetch-next boolean true


network.dns.disablePrefetch:
When false (the default), after a page is loaded, once Firefox is
"idle", Firefox will perform DNS lookups for references on the current
page so the loading of the next page clicked on will go faster since
some of the DNS entries needed for the next page would have already been
resolved. DNS entries are small as far as network traffic goes.

see https://developer.mozilla.org/en-US/docs/Controlling_DNS_prefetching

network.prefetch-next:
When true (the default), directives coded in the HTML to prefetch
objects for the next page(es) displayed. When Firefox is "idle", Netflix
will start fetching those objects. In some cases, this could include
objects from multiple pages. This could put more load on the network.

see http://kb.mozillazine.org/Network.prefetch-next
see https://developer.mozilla.org/en-US/docs/Link_prefetching_FAQ


Other activity that might keep the Internet connection in use would
include auto-reloading pages, and "rich content" that keeps on changing
(such as a video or sound file).

Some add-ins to Firefox may also be doing web checks. For example, with
Web Of Trust installed, a Google Search page or Google Images search is
littered with WOT circles, the color being a quick indication of site
trustworthiness (based mostly on other WOT user scores of that site) and
hovering the mouse over the WOT circle will display a brief score card
for that site. A page with lots of links would require a lot of
interaction with the WOT site and I don't know if the score cards are
downloaded ASAP or are fetched in background if not immediately needed.

A "cloud-based" virus checker may also be communicating with its "home"
to check objects in the current web page.

And a whole lot of programs will periodically check for updates and
download them, including Firefox itself and some add-ins.

Thanks for this, Mark, just goes to show that FF has changed since I
last used it.

Hopefully, Renny will read this and it will fix his situation!

Daniel

 

[Renny Bosch]

There isn't a menu choice for Prefetch in Firefox, but there are
optional settings in about:config (type about:config in the address bar
of Firefox).

The defaults are:

network.dns.disablePrefetch boolean false
network.prefetch-next boolean true

. . . .

Thanks for this extremely relevant information. I bit the bullet and
toggled both of those settings. Sadly it had no effect on the Network
Activity Indicator.
Are there some other settings that need to be toggled?

 

[Paul in Houston TX]

Thanks for this extremely relevant information. I bit the bullet and
toggled both of those settings. Sadly it had no effect on the Network
Activity Indicator.
Are there some other settings that need to be toggled?

If it does not do it when at about:blank, then the problem is more
with the websites and not really the browser.
afaik, the only way to stop websites from loading, refreshing,
calling home, and endlessly tracking your web presence is to turn
off the network connection. I use zone alarm and sometimes use that
to turn off the network while reading large webpages.

 

[Paul]

Thanks for this extremely relevant information. I bit the bullet and
toggled both of those settings. Sadly it had no effect on the Network
Activity Indicator.
Are there some other settings that need to be toggled?

So did you check the IP addresses/names of the things
being accessed yet ?

Paul

 

[Renny Bosch]

Sounds pretty normal to me. IE does the same with Google news.
Google news must have about 500 links per page and many of them
are loading themselves along with tons of tracking cookies.
And as Dan47 said, Mozilla has pre-fetch.

When I open Google News in IE 10, the Network Activity Indicator blinks
for about 5-10 seconds and then stops. In Firefox it's much much longer.