SlideShare una empresa de Scribd logo
1 de 59
Descargar para leer sin conexión
• Philip Tellis

•                    .com
• philip@lognormal.com
• @bluesmoon
• geek paranoid speedfreak
• http://bluesmoon.info/




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   1
I <3 JavaScript




Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   2
So much that I wore Mustache socks to my wedding




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   3
I’m also a Web Speedfreak




Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   4
We measure real user website performance




    Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   5
This talk is (mostly) about how we abuse JavaScript to do it




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   6
Messing with JS & the DOM to analyse the
                Network

     Philip Tellis / philip@lognormal.com


                  Web-5 / 2012-04-04




        Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   7
1
              Latency



Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   8
1 Blinking Lights




        It takes about 18ms for light to get from Béziers to Boston
                          (30ms through fibre)
   Image from http://cablemap.info

                              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   9
1 HTTP




         Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   10
So to measure latency, we need to send 1 packet each way, and
                           time it




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   11
Note about the code




                     Note that in the code,
                         + new Date
                        is equivalent to
                   new Date().getTime()




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   12
1   Network latency in JavaScript




      var ts, rtt, img = new Image;
      img.onload=function() { rtt=(+new Date - ts) };
      ts = +new Date;
      img.src="/1x1.gif";




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   13
2
   TCP handshake



Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   14
2 ACK-ACK-ACK




           Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   15
2 Connection: keep-alive




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   16
2   Network latency & TCP handshake in JavaScript
    var t=[], tcp, rtt;
    var ld = function() {
        t.push(+new Date);
        if(t.length > 2) // run 2 times
          done();
        else {
          var img = new Image;
          img.onload = ld;
          img.src="/1x1.gif?" + Math.random()
                               + ’=’ + new Date;
        }
    };
    var done = function() {
       rtt=t[2]-t[1];
       tcp=t[1]-t[0]-rtt;
    };
    ld();
                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   17
Notice that we’ve ignored DNS lookup time here... how would
                      you measure it?




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   18
1 Notes


    • 1x1 gif is 35 bytes
    • including HTTP headers, is smaller than a TCP packet
    • Fires onload on all browsers
    • 0 byte image fires onerror
    • which is indistinguishable from network error




                 Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   19
3
Network Throughput



 Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   20
3 Measuring Network Throughput



                            data_length
                           download_time




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   21
Should you fly a 747 or a 737?



       • A 747 seats 400+ passengers
       • A 737 seats about 150
       • Both take about the same time to fly from CDG to MPL
       • A 747 takes longer to load and unload




   The best selling aircraft to date is the 737

   This analogy would have been much cooler if the Concorde still flew




                                Web-5 / 2012-04-04     Messing with JS & the DOM to analyse the Network   22
Low Latency, Low Bandwidth




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   23
3   Network Throughput in JavaScript




    // Assume global object
    // image={ url: ..., size: ... }
    var ts, rtt, bw, img = new Image;
    img.onload=function() {
       rtt=(+new Date - ts);
       bw = image.size*1000/rtt;     // rtt is in ms
    };
    ts = +new Date;
    img.src=image.url;




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   24
3 Measuring Network Throughput



    If it were that simple, I wouldn’t be doing a talk at @web-5




                 Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   25
3 TCP Slow Start




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   26
3 Measuring Network Throughput



   So to make the best use of bandwidth, we need resources that fit
                         in a TCP window




                 Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   27
3 There is no single size that will tax all available networks




   http://www.yuiblog.com/blog/2010/04/08/analyzing-bandwidth-and-latency/




                             Web-5 / 2012-04-04       Messing with JS & the DOM to analyse the Network   28
3   Network Throughput in JavaScript – Take 2

    // image object is now an array of multiple images
    var i=0;
    var ld = function() {
       if(i>0)
          image[i-1].end = +new Date;
       if(i >= image.length)
          done();
       else {
          var img = new Image;
          img.onload = ld;
          image[i].start = +new Date;
          img.src=image[i].url;
       }
       i++;
    };

                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   29
3 Measuring Network Throughput



        Slow network connection, meet really huge image




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   30
3   Network Throughput in JavaScript – Take 3




       var img = new Image;
       img.onload = ld;
       image[i].start = +new Date;
       image[i].timer =
             setTimeout(function() {
                            image[i].expired=true
                        },
                        image[i].timeout);
       img.src=image[i].url;




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   31
3   Network Throughput in JavaScript – Take 3




    if(i>0) {
       image[i-1].end = +new Date;
       clearTimeout(image[i-1].timer);
    }




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   32
3   Network Throughput in JavaScript – Take 3




    if(i >= image.length
          || (i > 0 && image[i-1].expired)) {
       done();
    }




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   33
3 Measuring Network Throughput



                           Are we done yet?




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   34
3 Measuring Network Throughput



                           Are we done yet?
                               sure...




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   34
3 Measuring Network Throughput



    Except network throughput is different every time you test it




                 Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   35
Statistics to the Rescue




flickr/sophistechate/4264466015/
                                  Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   36
3 Measuring Network Throughput



          The code for that is NOT gonna fit on a slide




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   37
But this is sort of what we see world-wide




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   38
4     DNS



Web-5 / 2012-04-04    Messing with JS & the DOM to analyse the Network   39
4 Measuring DNS



           time_with_dns − time_without_dns




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   40
4   Measuring DNS in JavaScript
    var t=[], dns, ip, hosts=[’http://hostname.com/’,
                               ’http://ip.ad.dr.ess/’];
    var ld = function() {
        t.push(+new Date);
        if(t.length > hosts.length)
          done();
        else {
          var img = new Image;
          img.onload = ld;
          img.src=hosts[t.length-1] + "/1x1.gif";
        }
    };
    var done = function() {
       ip=t[2]-t[1];
       dns=t[1]-t[0]-ip;
    };
    ld();
               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   41
4 Measuring DNS



            What if DNS were already cached?




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   42
4 Measuring DNS



            What if DNS were already cached?
              Use a wildcard DNS entry




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   42
4 Measuring DNS



         What if you map DNS based on geo location?




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   43
4 Measuring DNS



         What if you map DNS based on geo location?
           A little more complicated, but doable




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   43
4 Measuring DNS



           Full code in boomerang’s DNS plugin




             Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   44
5     IPv6



Web-5 / 2012-04-04    Messing with JS & the DOM to analyse the Network   45
5 Measuring IPv6 support and latency


    1   Try to load image from IPv6 host
          • If timeout or error, then no IPv6 support
          • If successful, then calculate latency and proceed
    2   Try to load image from hostname that resolves only to IPv6
        host
          • If timeout or error, then DNS server doesn’t support IPv6
          • If successful, calculate latency




                   Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   46
5 Measuring IPv6 support and latency



             Full code in boomerang’s IPv6 plugin




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   47
6
Private Network Scanning



   Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   48
6 Private Network Scanning



      JavaScript in the browser runs with the User’s Security
                            Privileges




                Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   49
6 Private Network Scanning



         This means you can see the user’s private LAN




               Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   50
6 Private Network Scanning – Gateways


    1   Look at common gateway IPs: 192.168.1.1, 10.0.0.1, etc.
    2   When found, look for common image URLs assuming
        various routers/DSL modems
    3   When found, try to log in with default username/password
        if you’re lucky, the user is already logged in




                  Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   51
6 Private Network Scanning – Services


    1   Scan host range on private network for common ports (80,
        22, 3306, etc.)
    2   Measure how long it takes to onerror
          • Short timeout: connection refused
          • Long timeout: something listening, but it isn’t HTTP
          • Longer timeout: probably HTTP, but not an image
    3   Try an iframe instead of an image




                   Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   52
–
               .done()



Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   53
Code/References




    • http://github.com/bluesmoon/boomerang
    • http://samy.pl/mapxss/




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   54
• Philip Tellis

•                    .com
• philip@lognormal.com
• @bluesmoon
• geek paranoid speedfreak
• http://bluesmoon.info/




              Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   55
Thank you




Web-5 / 2012-04-04   Messing with JS & the DOM to analyse the Network   56

Más contenido relacionado

Similar a Messing with JS & the DOM to analyse the Network performance

Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"
Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"
Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"Philip Tellis
 
Messing with JavaScript and the DOM to measure network characteristics
Messing with JavaScript and the DOM to measure network characteristicsMessing with JavaScript and the DOM to measure network characteristics
Messing with JavaScript and the DOM to measure network characteristicsPhilip Tellis
 
Practical Performance Tips and Tricks to Make Your HTML/JavaScript Apps Faster
Practical Performance Tips and Tricks to Make Your HTML/JavaScript Apps FasterPractical Performance Tips and Tricks to Make Your HTML/JavaScript Apps Faster
Practical Performance Tips and Tricks to Make Your HTML/JavaScript Apps FasterDoris Chen
 
Optimising Web Application Frontend
Optimising Web Application FrontendOptimising Web Application Frontend
Optimising Web Application Frontendtkramar
 
Art and Science of Web Sites Performance: A Front-end Approach
Art and Science of Web Sites Performance: A Front-end ApproachArt and Science of Web Sites Performance: A Front-end Approach
Art and Science of Web Sites Performance: A Front-end ApproachJiang Zhu
 
EMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptx
EMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptxEMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptx
EMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptxThousandEyes
 
JavaOne2013 Leveraging Linked Data and OSLC
JavaOne2013 Leveraging Linked Data and OSLCJavaOne2013 Leveraging Linked Data and OSLC
JavaOne2013 Leveraging Linked Data and OSLCSteve Speicher
 
The Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and TakeawaysThe Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and TakeawaysThousandEyes
 
The Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and TakeawaysThe Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and TakeawaysThousandEyes
 
The case for HTTP/2
The case for HTTP/2The case for HTTP/2
The case for HTTP/2GreeceJS
 
The Case for HTTP/2 - GreeceJS - June 2016
The Case for HTTP/2 -  GreeceJS - June 2016The Case for HTTP/2 -  GreeceJS - June 2016
The Case for HTTP/2 - GreeceJS - June 2016Andy Davies
 
Web Performance Optimization @Develer
Web Performance Optimization @DevelerWeb Performance Optimization @Develer
Web Performance Optimization @DevelerMassimo Iacolare
 
Oracle Database Migration to Oracle Cloud Infrastructure
Oracle Database Migration to Oracle Cloud InfrastructureOracle Database Migration to Oracle Cloud Infrastructure
Oracle Database Migration to Oracle Cloud InfrastructureSinanPetrusToma
 
Large scale near real-time log indexing with Flume and SolrCloud
Large scale near real-time log indexing with Flume and SolrCloudLarge scale near real-time log indexing with Flume and SolrCloud
Large scale near real-time log indexing with Flume and SolrCloudDataWorks Summit
 
Massively Scaled High Performance Web Services with PHP
Massively Scaled High Performance Web Services with PHPMassively Scaled High Performance Web Services with PHP
Massively Scaled High Performance Web Services with PHPDemin Yin
 
Brocade AWS user group Sydney presentation
Brocade AWS user group Sydney presentationBrocade AWS user group Sydney presentation
Brocade AWS user group Sydney presentationPolarSeven Pty Ltd
 
SPDY - http reloaded - WebTechConference 2012
SPDY - http reloaded - WebTechConference 2012SPDY - http reloaded - WebTechConference 2012
SPDY - http reloaded - WebTechConference 2012Fabian Lange
 

Similar a Messing with JS & the DOM to analyse the Network performance (20)

Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"
Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"
Abusing JavaScript to measure Web Performance, or, "how does boomerang work?"
 
Messing with JavaScript and the DOM to measure network characteristics
Messing with JavaScript and the DOM to measure network characteristicsMessing with JavaScript and the DOM to measure network characteristics
Messing with JavaScript and the DOM to measure network characteristics
 
Final Presentation
Final PresentationFinal Presentation
Final Presentation
 
Practical Performance Tips and Tricks to Make Your HTML/JavaScript Apps Faster
Practical Performance Tips and Tricks to Make Your HTML/JavaScript Apps FasterPractical Performance Tips and Tricks to Make Your HTML/JavaScript Apps Faster
Practical Performance Tips and Tricks to Make Your HTML/JavaScript Apps Faster
 
Optimising Web Application Frontend
Optimising Web Application FrontendOptimising Web Application Frontend
Optimising Web Application Frontend
 
Art and Science of Web Sites Performance: A Front-end Approach
Art and Science of Web Sites Performance: A Front-end ApproachArt and Science of Web Sites Performance: A Front-end Approach
Art and Science of Web Sites Performance: A Front-end Approach
 
EMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptx
EMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptxEMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptx
EMEA.23.02.23_Top_Outages_of_2022_Webinar_Slides.pptx
 
JavaOne2013 Leveraging Linked Data and OSLC
JavaOne2013 Leveraging Linked Data and OSLCJavaOne2013 Leveraging Linked Data and OSLC
JavaOne2013 Leveraging Linked Data and OSLC
 
The Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and TakeawaysThe Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and Takeaways
 
The Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and TakeawaysThe Top Outages of 2022: Analysis and Takeaways
The Top Outages of 2022: Analysis and Takeaways
 
The case for HTTP/2
The case for HTTP/2The case for HTTP/2
The case for HTTP/2
 
The Case for HTTP/2 - GreeceJS - June 2016
The Case for HTTP/2 -  GreeceJS - June 2016The Case for HTTP/2 -  GreeceJS - June 2016
The Case for HTTP/2 - GreeceJS - June 2016
 
Web Performance Optimization @Develer
Web Performance Optimization @DevelerWeb Performance Optimization @Develer
Web Performance Optimization @Develer
 
Oracle Database Migration to Oracle Cloud Infrastructure
Oracle Database Migration to Oracle Cloud InfrastructureOracle Database Migration to Oracle Cloud Infrastructure
Oracle Database Migration to Oracle Cloud Infrastructure
 
Accessing Cloud Data and Services Using EDL, Pydap, MATLAB
Accessing Cloud Data and Services Using EDL, Pydap, MATLABAccessing Cloud Data and Services Using EDL, Pydap, MATLAB
Accessing Cloud Data and Services Using EDL, Pydap, MATLAB
 
Large scale near real-time log indexing with Flume and SolrCloud
Large scale near real-time log indexing with Flume and SolrCloudLarge scale near real-time log indexing with Flume and SolrCloud
Large scale near real-time log indexing with Flume and SolrCloud
 
Web Leaps Forward
Web Leaps ForwardWeb Leaps Forward
Web Leaps Forward
 
Massively Scaled High Performance Web Services with PHP
Massively Scaled High Performance Web Services with PHPMassively Scaled High Performance Web Services with PHP
Massively Scaled High Performance Web Services with PHP
 
Brocade AWS user group Sydney presentation
Brocade AWS user group Sydney presentationBrocade AWS user group Sydney presentation
Brocade AWS user group Sydney presentation
 
SPDY - http reloaded - WebTechConference 2012
SPDY - http reloaded - WebTechConference 2012SPDY - http reloaded - WebTechConference 2012
SPDY - http reloaded - WebTechConference 2012
 

Más de Philip Tellis

Improving D3 Performance with CANVAS and other Hacks
Improving D3 Performance with CANVAS and other HacksImproving D3 Performance with CANVAS and other Hacks
Improving D3 Performance with CANVAS and other HacksPhilip Tellis
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonPhilip Tellis
 
Frontend Performance: De débutant à Expert à Fou Furieux
Frontend Performance: De débutant à Expert à Fou FurieuxFrontend Performance: De débutant à Expert à Fou Furieux
Frontend Performance: De débutant à Expert à Fou FurieuxPhilip Tellis
 
Frontend Performance: Expert to Crazy Person
Frontend Performance: Expert to Crazy PersonFrontend Performance: Expert to Crazy Person
Frontend Performance: Expert to Crazy PersonPhilip Tellis
 
Beyond Page Level Metrics
Beyond Page Level MetricsBeyond Page Level Metrics
Beyond Page Level MetricsPhilip Tellis
 
Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...
Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...
Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...Philip Tellis
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonPhilip Tellis
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonPhilip Tellis
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonPhilip Tellis
 
RUM Distillation 101 -- Part I
RUM Distillation 101 -- Part IRUM Distillation 101 -- Part I
RUM Distillation 101 -- Part IPhilip Tellis
 
Improving 3rd Party Script Performance With IFrames
Improving 3rd Party Script Performance With IFramesImproving 3rd Party Script Performance With IFrames
Improving 3rd Party Script Performance With IFramesPhilip Tellis
 
The Statistics of Web Performance Analysis
The Statistics of Web Performance AnalysisThe Statistics of Web Performance Analysis
The Statistics of Web Performance AnalysisPhilip Tellis
 
A Node.JS bag of goodies for analyzing Web Traffic
A Node.JS bag of goodies for analyzing Web TrafficA Node.JS bag of goodies for analyzing Web Traffic
A Node.JS bag of goodies for analyzing Web TrafficPhilip Tellis
 
Boomerang: How fast do users think your site is?
Boomerang: How fast do users think your site is?Boomerang: How fast do users think your site is?
Boomerang: How fast do users think your site is?Philip Tellis
 
Boomerang at FOSS.IN/2010
Boomerang at FOSS.IN/2010Boomerang at FOSS.IN/2010
Boomerang at FOSS.IN/2010Philip Tellis
 
Measuring the web with Boomerang (YUIConf 2010)
Measuring the web with Boomerang (YUIConf 2010)Measuring the web with Boomerang (YUIConf 2010)
Measuring the web with Boomerang (YUIConf 2010)Philip Tellis
 

Más de Philip Tellis (20)

Improving D3 Performance with CANVAS and other Hacks
Improving D3 Performance with CANVAS and other HacksImproving D3 Performance with CANVAS and other Hacks
Improving D3 Performance with CANVAS and other Hacks
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
 
Frontend Performance: De débutant à Expert à Fou Furieux
Frontend Performance: De débutant à Expert à Fou FurieuxFrontend Performance: De débutant à Expert à Fou Furieux
Frontend Performance: De débutant à Expert à Fou Furieux
 
Frontend Performance: Expert to Crazy Person
Frontend Performance: Expert to Crazy PersonFrontend Performance: Expert to Crazy Person
Frontend Performance: Expert to Crazy Person
 
Beyond Page Level Metrics
Beyond Page Level MetricsBeyond Page Level Metrics
Beyond Page Level Metrics
 
Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...
Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...
Frontend Performance: Beginner to Expert to Crazy Person (San Diego Web Perf ...
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
 
Frontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy PersonFrontend Performance: Beginner to Expert to Crazy Person
Frontend Performance: Beginner to Expert to Crazy Person
 
mmm... beacons
mmm... beaconsmmm... beacons
mmm... beacons
 
RUM Distillation 101 -- Part I
RUM Distillation 101 -- Part IRUM Distillation 101 -- Part I
RUM Distillation 101 -- Part I
 
Improving 3rd Party Script Performance With IFrames
Improving 3rd Party Script Performance With IFramesImproving 3rd Party Script Performance With IFrames
Improving 3rd Party Script Performance With IFrames
 
Extending Boomerang
Extending BoomerangExtending Boomerang
Extending Boomerang
 
The Statistics of Web Performance Analysis
The Statistics of Web Performance AnalysisThe Statistics of Web Performance Analysis
The Statistics of Web Performance Analysis
 
Rum for Breakfast
Rum for BreakfastRum for Breakfast
Rum for Breakfast
 
A Node.JS bag of goodies for analyzing Web Traffic
A Node.JS bag of goodies for analyzing Web TrafficA Node.JS bag of goodies for analyzing Web Traffic
A Node.JS bag of goodies for analyzing Web Traffic
 
Input sanitization
Input sanitizationInput sanitization
Input sanitization
 
Boomerang: How fast do users think your site is?
Boomerang: How fast do users think your site is?Boomerang: How fast do users think your site is?
Boomerang: How fast do users think your site is?
 
Boomerang at FOSS.IN/2010
Boomerang at FOSS.IN/2010Boomerang at FOSS.IN/2010
Boomerang at FOSS.IN/2010
 
Measuring the web with Boomerang (YUIConf 2010)
Measuring the web with Boomerang (YUIConf 2010)Measuring the web with Boomerang (YUIConf 2010)
Measuring the web with Boomerang (YUIConf 2010)
 

Último

Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...gurkirankumar98700
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad
 
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Paola De la Torre
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure servicePooja Nehwal
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsRoshan Dwivedi
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking MenDelhi Call girls
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge
 

Último (20)

Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
Kalyanpur ) Call Girls in Lucknow Finest Escorts Service 🍸 8923113531 🎰 Avail...
 
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptxThe Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
 
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure serviceWhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men08448380779 Call Girls In Civil Lines Women Seeking Men
08448380779 Call Girls In Civil Lines Women Seeking Men
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 

Messing with JS & the DOM to analyse the Network performance

  • 1. • Philip Tellis • .com • philip@lognormal.com • @bluesmoon • geek paranoid speedfreak • http://bluesmoon.info/ Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 1
  • 2. I <3 JavaScript Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 2
  • 3. So much that I wore Mustache socks to my wedding Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 3
  • 4. I’m also a Web Speedfreak Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 4
  • 5. We measure real user website performance Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 5
  • 6. This talk is (mostly) about how we abuse JavaScript to do it Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 6
  • 7. Messing with JS & the DOM to analyse the Network Philip Tellis / philip@lognormal.com Web-5 / 2012-04-04 Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 7
  • 8. 1 Latency Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 8
  • 9. 1 Blinking Lights It takes about 18ms for light to get from Béziers to Boston (30ms through fibre) Image from http://cablemap.info Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 9
  • 10. 1 HTTP Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 10
  • 11. So to measure latency, we need to send 1 packet each way, and time it Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 11
  • 12. Note about the code Note that in the code, + new Date is equivalent to new Date().getTime() Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 12
  • 13. 1 Network latency in JavaScript var ts, rtt, img = new Image; img.onload=function() { rtt=(+new Date - ts) }; ts = +new Date; img.src="/1x1.gif"; Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 13
  • 14. 2 TCP handshake Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 14
  • 15. 2 ACK-ACK-ACK Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 15
  • 16. 2 Connection: keep-alive Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 16
  • 17. 2 Network latency & TCP handshake in JavaScript var t=[], tcp, rtt; var ld = function() { t.push(+new Date); if(t.length > 2) // run 2 times done(); else { var img = new Image; img.onload = ld; img.src="/1x1.gif?" + Math.random() + ’=’ + new Date; } }; var done = function() { rtt=t[2]-t[1]; tcp=t[1]-t[0]-rtt; }; ld(); Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 17
  • 18. Notice that we’ve ignored DNS lookup time here... how would you measure it? Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 18
  • 19. 1 Notes • 1x1 gif is 35 bytes • including HTTP headers, is smaller than a TCP packet • Fires onload on all browsers • 0 byte image fires onerror • which is indistinguishable from network error Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 19
  • 20. 3 Network Throughput Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 20
  • 21. 3 Measuring Network Throughput data_length download_time Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 21
  • 22. Should you fly a 747 or a 737? • A 747 seats 400+ passengers • A 737 seats about 150 • Both take about the same time to fly from CDG to MPL • A 747 takes longer to load and unload The best selling aircraft to date is the 737 This analogy would have been much cooler if the Concorde still flew Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 22
  • 23. Low Latency, Low Bandwidth Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 23
  • 24. 3 Network Throughput in JavaScript // Assume global object // image={ url: ..., size: ... } var ts, rtt, bw, img = new Image; img.onload=function() { rtt=(+new Date - ts); bw = image.size*1000/rtt; // rtt is in ms }; ts = +new Date; img.src=image.url; Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 24
  • 25. 3 Measuring Network Throughput If it were that simple, I wouldn’t be doing a talk at @web-5 Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 25
  • 26. 3 TCP Slow Start Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 26
  • 27. 3 Measuring Network Throughput So to make the best use of bandwidth, we need resources that fit in a TCP window Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 27
  • 28. 3 There is no single size that will tax all available networks http://www.yuiblog.com/blog/2010/04/08/analyzing-bandwidth-and-latency/ Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 28
  • 29. 3 Network Throughput in JavaScript – Take 2 // image object is now an array of multiple images var i=0; var ld = function() { if(i>0) image[i-1].end = +new Date; if(i >= image.length) done(); else { var img = new Image; img.onload = ld; image[i].start = +new Date; img.src=image[i].url; } i++; }; Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 29
  • 30. 3 Measuring Network Throughput Slow network connection, meet really huge image Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 30
  • 31. 3 Network Throughput in JavaScript – Take 3 var img = new Image; img.onload = ld; image[i].start = +new Date; image[i].timer = setTimeout(function() { image[i].expired=true }, image[i].timeout); img.src=image[i].url; Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 31
  • 32. 3 Network Throughput in JavaScript – Take 3 if(i>0) { image[i-1].end = +new Date; clearTimeout(image[i-1].timer); } Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 32
  • 33. 3 Network Throughput in JavaScript – Take 3 if(i >= image.length || (i > 0 && image[i-1].expired)) { done(); } Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 33
  • 34. 3 Measuring Network Throughput Are we done yet? Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 34
  • 35. 3 Measuring Network Throughput Are we done yet? sure... Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 34
  • 36. 3 Measuring Network Throughput Except network throughput is different every time you test it Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 35
  • 37. Statistics to the Rescue flickr/sophistechate/4264466015/ Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 36
  • 38. 3 Measuring Network Throughput The code for that is NOT gonna fit on a slide Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 37
  • 39. But this is sort of what we see world-wide Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 38
  • 40. 4 DNS Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 39
  • 41. 4 Measuring DNS time_with_dns − time_without_dns Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 40
  • 42. 4 Measuring DNS in JavaScript var t=[], dns, ip, hosts=[’http://hostname.com/’, ’http://ip.ad.dr.ess/’]; var ld = function() { t.push(+new Date); if(t.length > hosts.length) done(); else { var img = new Image; img.onload = ld; img.src=hosts[t.length-1] + "/1x1.gif"; } }; var done = function() { ip=t[2]-t[1]; dns=t[1]-t[0]-ip; }; ld(); Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 41
  • 43. 4 Measuring DNS What if DNS were already cached? Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 42
  • 44. 4 Measuring DNS What if DNS were already cached? Use a wildcard DNS entry Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 42
  • 45. 4 Measuring DNS What if you map DNS based on geo location? Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 43
  • 46. 4 Measuring DNS What if you map DNS based on geo location? A little more complicated, but doable Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 43
  • 47. 4 Measuring DNS Full code in boomerang’s DNS plugin Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 44
  • 48. 5 IPv6 Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 45
  • 49. 5 Measuring IPv6 support and latency 1 Try to load image from IPv6 host • If timeout or error, then no IPv6 support • If successful, then calculate latency and proceed 2 Try to load image from hostname that resolves only to IPv6 host • If timeout or error, then DNS server doesn’t support IPv6 • If successful, calculate latency Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 46
  • 50. 5 Measuring IPv6 support and latency Full code in boomerang’s IPv6 plugin Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 47
  • 51. 6 Private Network Scanning Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 48
  • 52. 6 Private Network Scanning JavaScript in the browser runs with the User’s Security Privileges Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 49
  • 53. 6 Private Network Scanning This means you can see the user’s private LAN Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 50
  • 54. 6 Private Network Scanning – Gateways 1 Look at common gateway IPs: 192.168.1.1, 10.0.0.1, etc. 2 When found, look for common image URLs assuming various routers/DSL modems 3 When found, try to log in with default username/password if you’re lucky, the user is already logged in Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 51
  • 55. 6 Private Network Scanning – Services 1 Scan host range on private network for common ports (80, 22, 3306, etc.) 2 Measure how long it takes to onerror • Short timeout: connection refused • Long timeout: something listening, but it isn’t HTTP • Longer timeout: probably HTTP, but not an image 3 Try an iframe instead of an image Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 52
  • 56. .done() Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 53
  • 57. Code/References • http://github.com/bluesmoon/boomerang • http://samy.pl/mapxss/ Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 54
  • 58. • Philip Tellis • .com • philip@lognormal.com • @bluesmoon • geek paranoid speedfreak • http://bluesmoon.info/ Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 55
  • 59. Thank you Web-5 / 2012-04-04 Messing with JS & the DOM to analyse the Network 56