Add update #8

content/post/2023/2023-04-16-att-traffic-shaping-makes-websites-unusable.md

@@ -217,3 +217,46 @@ My original `Forum Post 1` on the `bizcommunity` is still marked as private and
 
 My `Response and followup to Forum Post 2` has been deleted by a forum moderator. I presume if they provide any explanation, it will be that I linked to an external site. In any case, despite claiming to have direct messaged me, I never received a direct message from anyone, and they didn't seem to care that I didn't receive it.
 
+# Update #8 (2023-04-17 14:30:00)
+
+I figured it would be helpful to post some "post-incident" (I doubt it's actually over) data for completeness.
+
+Traceroute
+
+```
+traceroute web-assets.strava.com                                                                                                                                                    130 ↵
+traceroute to web-assets.strava.com (13.225.103.44), 30 hops max, 60 byte packets
+ 1  _gateway (192.168.13.31)  2.368 ms  2.292 ms  2.263 ms
+ 2  172.26.96.161 (172.26.96.161)  73.895 ms  85.170 ms  85.204 ms
+ 3  107.72.233.28 (107.72.233.28)  85.119 ms 107.72.233.4 (107.72.233.4)  85.447 ms 107.72.233.28 (107.72.233.28)  85.418 ms
+ 4  12.83.188.161 (12.83.188.161)  85.394 ms  85.370 ms  85.346 ms
+ 5  12.83.179.49 (12.83.179.49)  91.268 ms  91.242 ms  91.218 ms
+ 6  ggr2.la2ca.ip.att.net (12.122.128.97)  91.180 ms  76.697 ms  76.656 ms
+ 7  be3013.ccr41.lax05.atlas.cogentco.com (154.54.13.149)  1477.110 ms  79.291 ms  93.815 ms
+ 8  be3243.ccr41.lax01.atlas.cogentco.com (154.54.27.117)  93.796 ms  93.779 ms  93.762 ms
+ 9  be3176.ccr21.sjc01.atlas.cogentco.com (154.54.31.190)  377.948 ms be2327.ccr21.hkg02.atlas.cogentco.com (154.54.0.6)  237.357 ms  239.443 ms
+10  be2414.rcr51.hkg01.atlas.cogentco.com (154.54.88.50)  239.426 ms  377.871 ms  239.644 ms
+11  154.18.36.170 (154.18.36.170)  239.619 ms  239.602 ms be3585.ccr51.per01.atlas.cogentco.com (154.54.47.30)  307.318 ms
+12  be3929.ccr71.tyo01.atlas.cogentco.com (154.54.83.189)  283.628 ms  283.597 ms  241.812 ms
+13  * be2012.ccr51.tpe01.atlas.cogentco.com (66.28.4.234)  241.576 ms  241.701 ms
+14  * be2226.ccr21.hkg02.atlas.cogentco.com (154.54.40.137)  1778.342 ms *
+15  be2414.rcr51.hkg01.atlas.cogentco.com (154.54.88.50)  1776.152 ms  1776.096 ms *
+16  154.18.36.170 (154.18.36.170)  1776.049 ms * amazon.demarc.cogentco.com (154.18.7.2)  238.541 ms
+17  * * *
+18  * * *
+19  * * *
+20  * * *
+21  * server-13-225-103-44.hkg60.r.cloudfront.net (13.225.103.44)  336.093 ms *
+```
+
+We can see it's taking a distinctly different route from `Connected to router on AT&T business plan` from `Update #2`. Current resolver is `1.1.1.1`. I imagine some of you will spot that this was routed to Hong Kong...from Durango, CO. The internet is a mysterious place.
+
+Here is a pcap file captured with `sudo tcpdump host 'dgpcy4fyk1eox.cloudfront.net' -w post-incident-capture.pcap` while my router is connected to my AT&T business plan and fetching `827.js` with `wget -O /dev/null -q --show-progress https://web-assets.strava.com/assets/federated/find-and-invite-friends/827.js` : [post-incident-capture.pcap](/files/post-incident-capture.pcap)
+
+Throughput and RTT graphs from Wireshark of the above pcap file
+
+![post incident throughput](/img/post_incidient_throughput.png "post incident throughput")
+
+![post incident RTT](/img/post_incident_rtt.png "post incident RTT")
+
+