Hi there,
I have been doing an analyses with Adblock plus and Pi-hole. I found that AdBlock Plus have more TCP connection compare to Pi-Hole. However, the bandwidth consume almost the same between those two. I have attached the graph of my analyses. Yes, it showing a different behavior between the test case. But i need to investigate why TCP connection is more on Ad-block plus but less in Pi-hole. Anybody know the reason for this.
Thanks for the help.
Adblock plus and pretty much any browser level ad-blocker, acts like a content filter/local proxy.
Pi-hole on the other hand, does only DNS resolving.
is there any source i can read ?
i capture the packet at gateway side. it seems like the packet is from outside.
It is as @RamSet already said: With AdBlock Plus, the page is first loaded and then content is selectively removed/hidden/etc. However, it has been downloaded and would also be displayed if the browser plugin wouldn't hide it.
In contrast, with Pi-hole, requests to ad serving domains aren't even answered so your browser is not even able to establish TCP connections with the ad providers and - instead of getting hidden - the ad content is not even downloaded, i.e. also doesn't consume any bandwidth in transmit.
Thanks for the explanation. I agree with you. here is my analysis result. I found that Linux and Windows Os have different number of http request and tcp. But not for Pi-hole(http request). is it because Linux and Windows TCP stack or browser environment caused it different ?
Is it the same browser (same version?) on the two operating systems you compared?
both of them are using Chrome 67.0.3396.62
Okay, then this is strange. The browser is the origin of the requests and the system shouldn't be able to have an influence here. Thinking about it, it may something completely unrelated to your testing (background operating system telemetry). Try letting both systems run for a few hours without the browser started (leave all apps that were open active) and compare the results which should be zero for both in an ideal world.
I have done it 3 times in each test. it seems like, all test give different number of result. For packet filtering, i filtered it by time frame and excluded all packet accept for tcp.port==80 and http.
