diff --git a/content/post/2023/2023-04-16-att-traffic-shaping-makes-websites-unusable.md b/content/post/2023/2023-04-16-att-traffic-shaping-makes-websites-unusable.md index 8bfea0e..06bc0ac 100644 --- a/content/post/2023/2023-04-16-att-traffic-shaping-makes-websites-unusable.md +++ b/content/post/2023/2023-04-16-att-traffic-shaping-makes-websites-unusable.md @@ -217,3 +217,46 @@ My original `Forum Post 1` on the `bizcommunity` is still marked as private and My `Response and followup to Forum Post 2` has been deleted by a forum moderator. I presume if they provide any explanation, it will be that I linked to an external site. In any case, despite claiming to have direct messaged me, I never received a direct message from anyone, and they didn't seem to care that I didn't receive it. +# Update #8 (2023-04-17 14:30:00) + +I figured it would be helpful to post some "post-incident" (I doubt it's actually over) data for completeness. + +Traceroute + +``` +traceroute web-assets.strava.com 130 ↵ +traceroute to web-assets.strava.com (13.225.103.44), 30 hops max, 60 byte packets + 1 _gateway (192.168.13.31) 2.368 ms 2.292 ms 2.263 ms + 2 172.26.96.161 (172.26.96.161) 73.895 ms 85.170 ms 85.204 ms + 3 107.72.233.28 (107.72.233.28) 85.119 ms 107.72.233.4 (107.72.233.4) 85.447 ms 107.72.233.28 (107.72.233.28) 85.418 ms + 4 12.83.188.161 (12.83.188.161) 85.394 ms 85.370 ms 85.346 ms + 5 12.83.179.49 (12.83.179.49) 91.268 ms 91.242 ms 91.218 ms + 6 ggr2.la2ca.ip.att.net (12.122.128.97) 91.180 ms 76.697 ms 76.656 ms + 7 be3013.ccr41.lax05.atlas.cogentco.com (154.54.13.149) 1477.110 ms 79.291 ms 93.815 ms + 8 be3243.ccr41.lax01.atlas.cogentco.com (154.54.27.117) 93.796 ms 93.779 ms 93.762 ms + 9 be3176.ccr21.sjc01.atlas.cogentco.com (154.54.31.190) 377.948 ms be2327.ccr21.hkg02.atlas.cogentco.com (154.54.0.6) 237.357 ms 239.443 ms +10 be2414.rcr51.hkg01.atlas.cogentco.com (154.54.88.50) 239.426 ms 377.871 ms 239.644 ms +11 154.18.36.170 (154.18.36.170) 239.619 ms 239.602 ms be3585.ccr51.per01.atlas.cogentco.com (154.54.47.30) 307.318 ms +12 be3929.ccr71.tyo01.atlas.cogentco.com (154.54.83.189) 283.628 ms 283.597 ms 241.812 ms +13 * be2012.ccr51.tpe01.atlas.cogentco.com (66.28.4.234) 241.576 ms 241.701 ms +14 * be2226.ccr21.hkg02.atlas.cogentco.com (154.54.40.137) 1778.342 ms * +15 be2414.rcr51.hkg01.atlas.cogentco.com (154.54.88.50) 1776.152 ms 1776.096 ms * +16 154.18.36.170 (154.18.36.170) 1776.049 ms * amazon.demarc.cogentco.com (154.18.7.2) 238.541 ms +17 * * * +18 * * * +19 * * * +20 * * * +21 * server-13-225-103-44.hkg60.r.cloudfront.net (13.225.103.44) 336.093 ms * +``` + +We can see it's taking a distinctly different route from `Connected to router on AT&T business plan` from `Update #2`. Current resolver is `1.1.1.1`. I imagine some of you will spot that this was routed to Hong Kong...from Durango, CO. The internet is a mysterious place. + +Here is a pcap file captured with `sudo tcpdump host 'dgpcy4fyk1eox.cloudfront.net' -w post-incident-capture.pcap` while my router is connected to my AT&T business plan and fetching `827.js` with `wget -O /dev/null -q --show-progress https://web-assets.strava.com/assets/federated/find-and-invite-friends/827.js` : [post-incident-capture.pcap](/files/post-incident-capture.pcap) + +Throughput and RTT graphs from Wireshark of the above pcap file + +![post incident throughput](/img/post_incidient_throughput.png "post incident throughput") + +![post incident RTT](/img/post_incident_rtt.png "post incident RTT") + + diff --git a/static/files/post-incident-capture.pcap b/static/files/post-incident-capture.pcap new file mode 100644 index 0000000..f7bf47c Binary files /dev/null and b/static/files/post-incident-capture.pcap differ diff --git a/static/img/post_incident_rtt.png b/static/img/post_incident_rtt.png new file mode 100644 index 0000000..14d43d0 Binary files /dev/null and b/static/img/post_incident_rtt.png differ diff --git a/static/img/post_incidient_throughput.png b/static/img/post_incidient_throughput.png new file mode 100644 index 0000000..89d60ce Binary files /dev/null and b/static/img/post_incidient_throughput.png differ