What is *.bb.sky.com doing on port 80 (HTTP)?

[mmarsh]

Hi, I've seen this issue raised before without adequate explanation. When browsing the Web using SkyBroadband and the supplied NetGear router I see a lot of http (port 80) outbound traffic being automatically generated and sent to various servers in the bb.sky.com domain (e.g. b0fff641.bb.sky.com:80). Not only do the requests get made, they get ESTABLISHED too. No attempts at blocking the websites or adding additional firewall rules stop the connections from being made. I've tried this with various Windows XP installs and Ubuntu, but the connections ALWAYS come up when web browsing using either Windows Explorer or Firefox.

I've come to the conclusion that SKY make the connection when you start web browsing. This is either to track what people are browsing or, more likely, some kind of caching strategy. Does anyone see the same? If you want to take a look, run up the command 'cmd' (for Windows) and type 'netstat -a'. See if you can spot the outbound HTTP connection to bb.sky.com. Anyone have any ideas why this is needed? Is it a security risk? Thanks MM.

[Isitme]

Well if you are connecting using Sky broadband you have got to use the Sky servers. The b0fff641.bb.sky.com you quote, is the host name of the server, located near Skipton in Yorkshire. IP address 176.255.246.65, That is all.

[WheelNutWalter]

Well if you are connecting using Sky broadband you have got to use the Sky servers. The b0fff641.bb.sky.com you quote, is the host name of the server, located near Skipton in Yorkshire. IP address 176.255.246.65, That is all.

I could be wrong (although I don't think I am ), but I believe that is more likely to be someone's home router, as that style of hostname usually refer to the part of the Mac address of the router that the user uses.

My own DNS name for my connection is very similar. b01xxx8f.bb.sky.com (three characters masked with x characters because I'm paranoid).

If the connection is being established from your own computer as you suggest, you might want to run 'netstat -ano' and locate the PID of the process attempting to make the connection. Find the PID in task manager, if it's your browser, then the pages you are accessing must be referring to those hostnames.

Sky won't be making those connections, it could be some malware (dodgy web browser toolbars etc). Check the page source and look for links to those hostnames.

[Isitme]

Check here https://ipdb.at/ip/176.255.246.65 and you will see -

• Host Name: b0fff641.bb.sky.com

IP address is numbered 176.255.246.65. This IP address refers to United Kingdom. IP Country code is GB. ISP of this address is "Sky Broadband", organization is "Sky Broadband". It's host address is b0fff641.bb.sky.com. IP address longitude is -2.0 and latitude is 54.0.

[dragon2611]

Interesting there is a webserver at that IP

Not sure if it's someone running a server at home or something in Skys network though.

Invalid URL

The requested URL "/", is invalid.Reference #<Removed>

[Isitme]

If the OP does a tracert to bbc.co.uk, he will probably find that the 3rd hop is to 176.255.246.65

[mmarsh]

Interesting there is a webserver at that IP

Not sure if it's someone running a server at home or something in Skys network though.

Since this happens on Windows and Ubuntu and with different browsers so I'm assuming this is some kind of web relaying/caching that SKY do through Akamai. There's no rogue processes that are randomly connecting to these web servers. You get the randomized source port going to the bb.sky.com:80 web server generated through the browser. The NetGear router doesn't block it because it views it as part of the overall HTTP connection. Setting up a firewall rule or blocking it as a site on the router won't stop it either. I'm am absolutely convinced that anyone else who is actively browsing and runs 'netstat -a' will see exactly the same connections being forged. It's just how SkyBroadband works. Here's a half decent trick to see what the web server is (they're all Akamai servers by the way):

C:\> telnet b0fff641.bb.sky.com 80
HEAD / HTTP/1.0 <CR><CR>

HTTP/1.0 400 Bad Request
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 194
Expires: Tue, 11 Dec 2012 20:22:21 GMT
Date: Tue, 11 Dec 2012 20:22:21 GMT
Connection: close
Thanks for the responses. If anyone has the same experience please add to the data.

[dragon2611]

It wouldn't surprise me if Akamai have an on-network CDN node since sky are a fairly large ISP.

What you might find is when you visit the BBC.etc the dynamic content is served from the actuall BT servers but the CDN node serves up the media content (Images/video's.etc)

[WheelNutWalter]

Check here https://ipdb.at/ip/176.255.246.65 and you will see -

These services are very inaccurate, especially where dynamic IP addresses are concerned.

I've just put four of our office IP addresses in. Three claim to be at that exact same location as the link you've posted above, and one claims to be in London. - All wrong.

[Isitme]

I've just put four of our office IP addresses in. Three claim to be at that exact same location as the link you've posted above, and one claims to be in London. - All wrong.

I agree, my location has not been recorded correctly once since I moved to the SVBN. Before that it was extremely accurate. I am seldom recorded as being in the correct country, never mind some miles of my location. I think they are reporting where the address is registered, not its actual location.