On: Company withdrawing from Facebook as analytics sho...

[biot]

It works off of checking the SYN packet [0], which happens at the transport layer [1]. Once it gets to the application layer the information is not available unless the transport layer stores the information and provides a method to query a given connection.

[0] http://www.openbsd.org/faq/pf/filter.html#osfp

[1] http://en.wikipedia.org/wiki/OSI_model

[dredmorbius → biot]

I suspected something like this, but was hoping enough of the signature might survive for a daemon (or Java class acting as one) to take a peek.