me/adriano.fyi
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add DNS info to Update #8

Browse source
This commit is contained in:
Adriano Caloiaro 2023-04-17 09:02:50 -06:00
parent ede416bdfa
commit 0748aa2511
No known key found for this signature in database
GPG key ID: C2BC56DE73CE3F75
1 changed files with 45 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
content/post/2023/2023-04-16-att-traffic-shaping-makes-websites-unusable.md
View file

@ -221,7 +221,7 @@ My `Response and followup to Forum Post 2` has been deleted by a forum moderator
I figured it would be helpful to post some "post-incident" (I doubt it's actually over) data for completeness.
Traceroute
### Traceroute
```
traceroute web-assets.strava.com 130 ↵
@ -251,6 +251,50 @@ traceroute to web-assets.strava.com (13.225.103.44), 30 hops max, 60 byte packet
We can see it's taking a distinctly different route from `Connected to router on AT&T business plan` from `Update #2`. Current resolver is `1.1.1.1`. I imagine some of you will spot that this was routed to Hong Kong...from Durango, CO. The internet is a mysterious place.
### Current DNS Resolution
```
host web-assets.strava.com
web-assets.strava.com is an alias for dgpcy4fyk1eox.cloudfront.net.
dgpcy4fyk1eox.cloudfront.net has address 13.33.21.106
dgpcy4fyk1eox.cloudfront.net has address 13.33.21.119
dgpcy4fyk1eox.cloudfront.net has address 13.33.21.16
dgpcy4fyk1eox.cloudfront.net has address 13.33.21.44
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:8e00:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:1400:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:a600:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:9400:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:2600:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:ac00:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:ec00:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2363:3800:17:4613:2840:93a1
```
Note this is a completely different set of hosts from "during the incident". I'm not sure that this new host list is in any way related to this being "post-incident". Cloudflare runs a lot of POPs, and I'm not about to try to understand the interplay between my resolver `1.1.1.1` and Cloudflare's global DNS. It's notable, in any case.
### During incident DNS resolution
For reference, these are the host from "during the incident". I can't say with 100% certainty, but I believe I was using `1.1.1.1` as a resolver at the time, and whether I was connected via iphone tether or LTE router, I received the same host list:
```
host web-assets.strava.com
web-assets.strava.com is an alias for dgpcy4fyk1eox.cloudfront.net.
dgpcy4fyk1eox.cloudfront.net has address 99.84.208.46
dgpcy4fyk1eox.cloudfront.net has address 99.84.208.56
dgpcy4fyk1eox.cloudfront.net has address 99.84.208.10
dgpcy4fyk1eox.cloudfront.net has address 99.84.208.115
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:8000:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:e600:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:c600:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:b600:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:d000:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:6400:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:f000:17:4613:2840:93a1
dgpcy4fyk1eox.cloudfront.net has IPv6 address 2600:9000:2199:400:17:4613:2840:93a1
```
### Pcap data & analysis
Here is a pcap file captured with `sudo tcpdump host 'dgpcy4fyk1eox.cloudfront.net' -w post-incident-capture.pcap` while my router is connected to my AT&T business plan and fetching `827.js` with `wget -O /dev/null -q --show-progress https://web-assets.strava.com/assets/federated/find-and-invite-friends/827.js` : [post-incident-capture.pcap](/files/post-incident-capture.pcap)
Throughput and RTT graphs from Wireshark of the above pcap file