[HN Gopher] AT&T Wireless traffic shaping apparently making some...
       ___________________________________________________________________
        
       AT&T Wireless traffic shaping apparently making some websites
       unusable
        
       Author : acaloiar
       Score  : 293 points
       Date   : 2023-04-16 18:06 UTC (4 hours ago)
        
 (HTM) web link (adriano.fyi)
 (TXT) w3m dump (adriano.fyi)
        
       | j1elo wrote:
       | This might, in a very "take it with a pinch of salt" way, be
       | actually _good_ for stirring up the incentives of lazy web devs
       | (read: greedy bosses who don 't care about technical prowess) to
       | make slimmer websites... if enough people in the developed world
       | have issues accessing them, it might at last have the effect that
       | couldn't be achieved by probably orders of magnitude more people
       | having worse issues from developing countries.
        
         | dsfyu404ed wrote:
         | >(read: greedy bosses who don't care about technical prowess)
         | 
         | Oh come on. There's plenty of ICs out there who'll happily do
         | slapdash work because nobody cares if you close tickets well as
         | long as you close them good enough. So what if the fix only
         | lasts 2yr before needing to be refactored for performance. Lord
         | knows if the code will even be in use then.
        
           | j1elo wrote:
           | Yeah... I was just anticipating the opposite kind of
           | responses: "we web debs would like to make things right but
           | our bosses don't care and expect it to be made fast even if
           | fat"
        
       | jskier wrote:
       | Ditto, same in a rural area of Wisconsin I'm at a lot, for the
       | past 3 years or so. Like, 3/4 of the Internet is slow through
       | their shaping garbage. What worked for me was using WireGuard to
       | my home network in an urban area (1 gig symmetrical fiber), or,
       | using an ssh ~ socks proxy. Problems no more, until they decide
       | to block those.
       | 
       | Support has been awful, best of luck if you go that route. They
       | took us off their unlimited plan without consent, took 6 months
       | to get it back. Also, throttling doesn't actually seem to happen
       | once over their limit on the advertised unlimited* data plan,
       | it's just most of the Internet is awfully slow most of the time
       | going directly through this, ah, ISP, which they claim to be.
       | 
       | * Not actually an unlimited plan
        
         | reaperman wrote:
         | I use a VPN to a cheap server in a lesser-known datacenter.
         | Also works for bypassing government level blocks in middle
         | eastern countries.
         | 
         | But yes, AT&T throttles a wide diversity of content, even on
         | their very highest tier plan (Unlimited Elite, now named
         | Unlimited Premium). This is advertised as never throttling, no
         | matter how much data you use (all other customers are supposed
         | to get throttled first).
         | 
         | Also the throttling happens with mobile hotspot, I have to use
         | VPN on my laptop with many many sites as well, even when I'm
         | inside the "40GB/mo of unthrottled hotspot data".
         | 
         | The speeds instantly go way, way up once I hop on VPN.
        
       | Tarball10 wrote:
       | AT&T uses different APNs for regular phone plans and data-only
       | hotspot plans. It's very possible that the phone traffic is being
       | routed completely differently than the hotspot traffic, with
       | congestion at a peering point occurring on the hotspot. AT&T
       | tends to be known for having poor/congested peering.
       | 
       | You could try changing the DNS server on your hotspot to a
       | different public resolver like 1.1.1.1 or 8.8.8.8. If CloudFront
       | is using DNS based geolocation to route you to the nearest data
       | center, a different DNS server may get you routed around the
       | issue to a different data center.
        
         | Rimintil wrote:
         | Use resolvers that support eDNS Client Subnet, otherwise geo-
         | resolvers like Google/CF DNS may cause your traffic to be
         | misrouted.
         | 
         | You can use Quad9's EDNS [0] so your client is properly routed,
         | any privacy concerns aside.
         | 
         | [0] https://www.quad9.net/support/faq/#edns
        
           | overstay8930 wrote:
           | Quad9 doesn't work on AT&T, because of poor routing you're
           | sent to Miami or Amsterdam.
        
         | acaloiar wrote:
         | Good tip. I just tried with both and wasn't routed to a faster
         | point of presence with either.
         | 
         | I'll add a traceroute from the phone and one from a device
         | connected to the LTE router to the updates section next.
         | 
         | [update] Traceroutes added
        
           | Tarball10 wrote:
           | It's definitely odd that you're getting routed across the
           | country to an east coast pop. Ideally in your location you'd
           | be routed to a west or central pop. Perhaps a bad combination
           | of Cloudfront getting geolocation wrong for your IP range,
           | and poor performance of at&t's network for that specific
           | source-destination combination.
        
             | acaloiar wrote:
             | I found that odd as well, and my iPhone hotspot does get
             | routed through a different list of hosts as you can see in
             | the traceroute.
             | 
             | I suppose it should be noted. The iphone antenna and router
             | antennas are no more than a meter from each other. They're
             | unlikely to be hitting different towers.
        
       | themagician wrote:
       | A decade long fight about Net Neutrality in the public, and the
       | ISPs just went and did what they were always going to do anyway
       | in the background. No surprise. No news. No fanfare. Just,
       | "Here's your broken internet where every websites loads at a
       | different speed. Get Unlimited* access with a 35GB limit before
       | more limits kick in. Some websites are unusable. Enjoy. * _Some
       | limits apply. See T &C for details._"
        
         | twoodfin wrote:
         | Net Neutrality was never going to apply to mobile networks
         | under any FCC proposal.
        
         | Scoundreller wrote:
         | But OP _is_ paying for the first 50gb /month to be a "business"
         | unthrottled connection on their unlimited connection!
        
       | ivalm wrote:
       | How does traffic shaping interact with net neutrality
       | regulations?
        
         | downWidOutaFite wrote:
         | There are no net neutrality regulations. Republicans won that
         | battle at the FCC.
        
         | PuffinBlue wrote:
         | Like a neutrino interacting with regular matter, it would seem.
        
         | CamperBob2 wrote:
         | What net neutrality regulations?
         | 
         | Yet another Trump triumph that I voted for Biden to fix, that
         | he has shown absolutely no interest in fixing.
        
         | knome wrote:
         | Net neutrality was removed under Ajit Pai's time leading the
         | FCC. Did I miss some post-Pai restoration?
        
         | exabrial wrote:
         | Easy.
         | 
         | goto here: https://www.att.com/support
         | 
         | log in.
         | 
         | cancel.
         | 
         | tell them why.
         | 
         | goto https://www.t-mobile.com
         | 
         | port your number and sign up.
         | 
         | and you're done!
         | 
         | You can't legislate good behavior. You can only hit them in the
         | checkbook. Wireless fortunately doesn't have the cable
         | providers do, where local governments have entrenched players
         | into local monopolies. Switching away is the most powerful
         | thing you can do.
        
           | whatshisface wrote:
           | This seems like a good idea if t-mobile doesn't have traffic
           | shaping, but do they?
        
             | dublinben wrote:
             | T-Mobile was one of the earliest violators of net-
             | neutrality:
             | https://cyberlaw.stanford.edu/publications/t-mobile-
             | likely-v...
        
           | pnw wrote:
           | I'd be happy to switch to T Mobile if they could stop leaking
           | their customers data.
        
             | exabrial wrote:
             | ok, fair point.
        
           | iSnow wrote:
           | >You can't legislate good behavior.
           | 
           | Well, you absolutely can. It's just that the US voter
           | regularly votes in politicians that do absolutely nothing to
           | mandate at least fair behaviour.
        
           | downWidOutaFite wrote:
           | lol as if ATT is going to care if a tiny handful of techies
           | switches because of this.
        
         | mullingitover wrote:
         | Wireless providers have never had the same net neutrality
         | situation the landlines providers have.
        
       | snapcaster wrote:
       | This explains some similar behavior I've had with various apps
       | taking absurdly long to load when the internet connection itself
       | feels fine. Assumed it was just iPhone's gradually getting
       | shittier
        
         | pimlottc wrote:
         | Now that you mention this, it does match my experience on AT&T
         | with my iPhone - plenty of bars, no DNS issues but
         | frustratingly long delays spent staring at layout templates
         | (because progressive enhancement is long dead) waiting for any
         | actual content to arrive.
        
       | lotsofpulp wrote:
       | > This is an "unlimited" 100Mbit plan with 50GB for Business Fast
       | Track (prioritized) data. Being that I was far below the 50GB of
       | monthly Fast Track data, my data should have had top priority, so
       | I became suspicious.
       | 
       | And yet ATT will get away with this fraud or theft of selling
       | something it is not delivering because no one in government wants
       | to hold them accountable.
        
       | anecdotal1 wrote:
       | Get Calyx. Unlimited data, no throttling service via T-Mobile.
       | Grandfathered contract from Clearwire
       | 
       | https://members.calyxinstitute.org/enroll/membership
       | 
       | I've done nearly gigabit symmetrical over 5G with it before and
       | several Terabytes in a month. No issues.
        
       | explorer83 wrote:
       | I like the testing and documentation. But I also want to see more
       | test results in more areas over a longer period of time.
        
         | acaloiar wrote:
         | While I can't provide more results over a long period of time,
         | yet -- I can provide a pcap file and some details about IPv4/6.
         | 
         | I've added an "updates" section at the bottom of the post.
        
           | explorer83 wrote:
           | Excellent! I've bookmarked the page and look forward to
           | updates. Thank you for making this public.
        
       | taf2 wrote:
       | What's the best way to simulate this kind of network?
        
         | pyrolistical wrote:
         | Throttle all traffic from cloundfront
        
       | maximilianroos wrote:
       | > for some reason, AT&T traffic to fast.com is throttled. Why
       | AT&T wants bandwidth to appear lower than reality is a mystery to
       | me
       | 
       | My guess is that Netflix is throttled, and given that fast.com is
       | a Netflix site, fast.com is throttled too.
        
         | oh_sigh wrote:
         | Since almost everyone usingfast.com on an AT&t network also use
         | AT&t DNS, I'm surprised they don't do something funky with
         | that, for example throttling IPs that did a recent Netflix.com
         | lookup, but not IPs that did a recent fast.com lookup
        
           | jrockway wrote:
           | Because if this was a workaround to get better Netflix
           | quality, then there would be 1000 blogspam articles about it.
           | It's too good to be true ("visit fast.com to make Netflix
           | load faster"), and the Internet loves that kind of thing.
        
         | dghlsakjg wrote:
         | Netflix intentionally hosts fast.com on the same IPs as their
         | video sites. It is a very intentional way for consumers to see
         | if their isp is throttling Netflix.
        
       | ekosz wrote:
       | We've been hearing complaints from AT&T users for months now that
       | our website (https://vstream.com) doesn't work for them. I've
       | tried hunting down the reasons & tried getting in touch with AT&T
       | to no avail. This seems like it could be the very thing that's
       | causing the issues for our users.
       | 
       | Now I just need to figure out what to tell our users that are
       | having these issues...
        
         | Tarball10 wrote:
         | This appears to load fine for me on both AT&T fiber and AT&T
         | cellular. It looks like all content on that site is being
         | loaded from Cloudflare, so I'm curious if those users would be
         | having issues with other Cloudflare protected sites as well?
        
         | acaloiar wrote:
         | I believe I can confirm that vstream.com is affected by this.
         | It fails to fully load in a reasonable amount of time unless I
         | connect via VPN, Verizon, or my (phone) hotspot.
         | 
         | Update: For what it's worth, the "above the fold" portion of
         | the content loads down to "All Debuts". After that, there's a
         | long blank space with a Loading indicator near the bottom.
         | Eventually it loaded. I didn't keep track of how long, but it
         | was almost certainly longer than 1 minute.
        
       | varenc wrote:
       | One nit of the author's analysis:
       | 
       | The Strava javascript file used for speed tests is 1.68MB
       | uncompressed. But in a browser and most all other situations it
       | should be requested with `Accept-Encoding: ...`. In Chrome,
       | Strava responds with a gzipped response that's 463kB in size.
       | 
       | This doesn't really matter for the CLI speed tests, when its
       | requested without compression, but it does mean that the speed
       | test performance won't correspond with the actual in-browser
       | performance and the traffic shaping may not be comparable when
       | the request is made without compression. Adding
       | `--compression=gzip` to the wget command will fix this.
       | 
       | To quickly show the difference:                  $ curl -s
       | 'https://web-assets.strava.com/assets/federated/find-and-invite-
       | friends/827.js'  --compressed -w '%{size_download}\n' -o
       | /dev/null        462525        $ curl -s 'https://web-
       | assets.strava.com/assets/federated/find-and-invite-
       | friends/827.js' -w '%{size_download}\n' -o /dev/null
       | 1759662
        
         | acaloiar wrote:
         | Fair nit. Although this is why I chose to focus on transfer
         | rates instead of time.
         | 
         | But consider this. When I load Strava's dashboard, open the
         | Network tab and search for "cloudfront", these are the metrics:
         | 
         | > 374 requests 15.80 MB / 7.07 MB transferred Finish: 4.89 min
         | 
         | This is not a good time, and no amount of compression is going
         | to help the situation.
        
       | Bluecobra wrote:
       | Makes me wonder if it's just something as simple as suboptimal
       | routing and the path it's taking is through a hop experiencing
       | packet loss or some other issue further upstream. I would think
       | that there's a higher chance of AT&T being incompetent then doing
       | something nefarious.
        
       | justsomehnguy wrote:
       | > Why AT&T wants bandwidth to appear lower than reality is a
       | mystery to me, but I digress
       | 
       | For you a speed test is just once in a life time event.
       | 
       | For a _wireless_ provider this is a thing what clogs the _shared
       | media_ of a radio channel for quite a lot (modern speed tests try
       | to push 100 or even more M _Bytes_?) and cause a disruption for
       | everyone else on the same channel.
       | 
       | I don't know why ATT throttles (if at all, not a customer) that
       | site, but wire and wireless providers are different.
        
         | DanAtC wrote:
         | fast.com was created by Netflix to show if your ISP was
         | throttling Netflix traffic.
         | 
         | A lot of mobile services (at least in the US) offer "unlimited
         | streaming" which is really just bandwidth-limited to offer SD-
         | quality streams and offer "HD" (read: less-limited) streaming
         | as a paid add-on.
        
         | dublinben wrote:
         | >For Netflix, part of the message is: If you've got a bandwidth
         | problem, don't blame us -- blame your ISP.[0]
         | 
         | This coverage from when Netflix launched Fast.com in 2016
         | alludes to the reason why the results on Fast.com may be slower
         | than on something like Speedtest.net. ISPs like AT&T throttle
         | connections to streaming video providers like Netflix, in order
         | to force a lower quality stream. By offering a speed test from
         | the same infrastructure that delivers your TV show, they are
         | revealing the 'traffic shaping' that is degrading your
         | connection. Sites like Speedtest.net are all excluded from this
         | throttling, so it will always appear that you are getting 'full
         | speed' when testing your connection.
         | 
         | [0] https://variety.com/2016/digital/news/netflix-fast-
         | internet-...
        
           | fjni wrote:
           | I never thought about this much, but what's interesting is
           | that there's a missed opportunity for collaboration here.
           | 
           | I think most ISPs throttle known streaming sites (netflix,
           | youtube, etc.) by default for mobile plans. Some even
           | advertise it [1]. And really what the ISPs have noticed is
           | that if you throttle the throughput, the streaming services
           | will switch to a lower quality stream (e.g. 720 or even 480
           | instead of 1080p) to allow for non-lagging streams.
           | 
           | So in some weird way the streaming sites are the ones that
           | provided the tool and the ISPs figured out how to exploit it.
           | 
           | The two could have just worked together on a solution. Here
           | they are pointing the finger at each other. ISPs don't want
           | to have default 1080p streams for 4" device screens (which
           | makes sense,) and streaming services don't want their network
           | traffic throttled (which also makes sense.)
           | 
           | [1] https://www.t-mobile.com/offers/binge-on-streaming-video
        
             | vitus wrote:
             | > The two could have just worked together on a solution.
             | 
             | We do...? Google Global Cache [0] and Netflix Open Connect
             | [1] are both the result of ISP partnerships wherein we
             | deploy cache nodes in the ISP's datacenter to reduce
             | network load and improve our users' viewing experience.
             | 
             | Whether a specific ISP chooses to partner with us or not
             | (and the breadth of their deployment) depends on their
             | willingness to sign the relevant contracts.
             | 
             | [0] https://support.google.com/interconnect/answer/9058809?
             | hl=en
             | 
             | [1] https://openconnect.netflix.com/en/
        
               | fjni wrote:
               | I didn't know about that. That's cool.
        
       | crazygringo wrote:
       | But why would AT&T be throttling Cloudfront requests
       | specifically?
       | 
       | That's not traffic shaping, it's just dumb. Traffic shaping is
       | slowing down _types_ of traffic like torrents or video in order
       | to prioritize regular sites. But this is degrading regular sites
       | that are usually what _benefit_ from traffic shaping if there 's
       | overall network congestion.
       | 
       | I'm not questioning anything the author reports, it all seems
       | extremely well documented.
       | 
       | I am questioning what AT&T is trying to accomplish here though.
       | It makes no sense, unless they're in some kind of negotiation
       | with Cloudfront right now, punishing them until they pay up or
       | something? But that doesn't explain why it would only happen on a
       | data-only plan. I'm mystified.
        
         | fjni wrote:
         | I think the era of traffic shaping as you describe it is no
         | longer. Most connections are encrypted these days, a good
         | thing. But that also means, me as an ISP in the middle, I only
         | see the layer 4 packet. So I know where a packet is coming from
         | and where it's going (and ttl and some other not really helpful
         | data for this purpose.) I don't even know the port.
         | 
         | So I'm left with doing (dumb) traffic shaping by destination
         | and target.
         | 
         | If I had to guess, I'd say that they incorrectly thought that
         | some specific IP address (range) serves predominantly one type
         | of data. So they throttle by the only data point they have,
         | destination ip, and the collateral damage is everything else
         | hosted on that ip address.
        
           | kaszanka wrote:
           | Wait, why wouldn't they know the port? I'm not aware of any
           | cases where the TCP header itself is encrypted.
        
             | fjni wrote:
             | You are correct. The port is part of the tcp header and my
             | statement above is incorrect!
        
             | kevincox wrote:
             | 99% of consumer traffic is on 443 these days (citation
             | needed)
        
               | robocat wrote:
               | HTTP3 uses UDP and doesn't have to use the same port,
               | although I presume it does. "A browser first connects the
               | server with HTTP/2 To discover the service. The server
               | responses with an Alt-Svc header, including the port for
               | HTTP/3, such as Alt-Svc: h3-29=":443""
        
           | kevin_nisbet wrote:
           | So I had this conversation with one of the traffic shaping
           | vendors many years ago. At the time when encryption still
           | wasn't that common, they didn't sound too worried about the
           | shift to all encrypted connections. Their product was already
           | starting to use a behavioral analysis to shape the traffic
           | most of their customers were interested in.
           | 
           | So to detect bittorrent, they'd build a profile about how
           | many bit torrent clients operate, the packet and connection
           | creation patterns used, and then slap a throttle on. Looking
           | at some independent analysis, these products might only
           | detect 50% of the bittorent traffic, and have a false
           | positive rate, especially for bittorent users also doing
           | something else. And the ISPs don't care, they get what they
           | need if they clamp 50% of the traffic.
           | 
           | So I'm not disputing that everything encrypted is a good
           | thing, just pointing out that because it's encrypted doesn't
           | necessarily mean the shaping equipment can't figure out
           | enough to throttle bit torrent.
           | 
           | > If I had to guess, I'd say that they incorrectly thought
           | that some specific IP address (range) serves predominantly
           | one type of data. So they throttle by the only data point
           | they have, destination ip, and the collateral damage is
           | everything else hosted on that ip address.
           | 
           | This is plausible. As I recall, the way some of the equipment
           | worked was it would sniff out DNS requests, and then mark the
           | IP address as this destination. So if someone set's a rule
           | for example.com, it might accidentally apply to alice.com
           | using the same IP address.
           | 
           | My knowledge on the industry is out of date though.
        
             | fjni wrote:
             | This is great insight. Thank you for that.
             | 
             | I imagine lots of people are or have spent lots of money
             | and time trying to figure out the type of data or
             | connection from patterns as you say.
             | 
             | A more nuanced and correct statement would have been to say
             | that it's much harder to do than it used to be, when you
             | could just look at the mime-type or similar to figure out
             | what to throttle.
        
               | Meleagris wrote:
               | If you're interested in learning more, deep packet
               | inspection, and specifically "encrypted traffic
               | classification" are fairly mature in industry. Many
               | traffic shapers are using products like Enea's Qosmos
               | ixEngine or home-grown equivalents which can identify
               | thousands of applications and protocols.
               | 
               | Most providers that use traffic shaping don't care about
               | content, and the encrypted traffic classification is
               | enough to make traffic policy decisions.
        
       | lordgrenville wrote:
       | > While wget is not my goto for command line HTTP fetching
       | 
       | It is for me. Is there something better I'm not aware of?
        
       | Animats wrote:
       | Remember how 5G was supposed to support "the metaverse"?[1]
       | 
       | I've been working on a high performance metaverse client. All
       | Rust, all multi-threaded. Designed to max out a gamer PC.
       | Supports Second Life and Open Simulator. Second Life had a
       | reputation for being sluggish. Fixing that.
       | 
       | I'm pulling content from the servers at 200Mb/s, sustained.
       | 400Mb/s in tests, but don't need to go that fast. The servers
       | (AWS front-ended by Akamai caches) can handle that just fine.
       | Gigabit fiber can handle that just fine. The 3D world appears in
       | high detail in seconds. Looks like an AAA game title. Not like
       | low-rez Meta Horizon or Decentraland.
       | 
       | 5G can handle that, right? Says so right here in the promotional
       | materials.Verizon: [2] AT&T: [3]
       | 
       | The carriers said "unlimited", right? So they can't complain if
       | you're downloading 100GB per hour.
       | 
       | [1]
       | https://www.forbes.com/sites/michaelgale/2022/05/24/how-5-an...
       | 
       | [2] https://www.ericsson.com/en/blog/2022/4/why-metaverse-
       | needs-...
       | 
       | [3] https://www.verizon.com/about/news/5g-makes-metaverse-real
       | 
       | [4] https://www.xrtoday.com/event-news/5g-networks-crucial-to-
       | me...
        
         | dboreham wrote:
         | Unlimited is a term of art that means "limited".
        
           | xeromal wrote:
           | Yup. Buffets have been that way forever. No one is actually
           | allowed to eat unlimited.
        
             | Dylan16807 wrote:
             | I'm not sure what you mean. Most buffets won't limit you.
        
               | xeromal wrote:
               | There is always a limit even if it's not published.
        
               | Dylan16807 wrote:
               | For what purpose? People can only eat so much. The buffet
               | doesn't have to limit you. And if the buffet isn't
               | limiting you then it's valid for them to say "unlimited".
        
             | bobbean wrote:
             | But I'll eat until they kick me out. That's how I know I
             | got my moneys worth
        
           | DangitBobby wrote:
           | Can we just start calling fraud by its own name?
        
             | doublerabbit wrote:
             | I'll order one criminality with extra politicians and one
             | large diet-fraud-lite(tm) with extra ice.
             | 
             | Just charge it to my offshore. Cheers
        
         | cbsks wrote:
         | Are you insinuating, sir, that a telecommunications company has
         | lied to the public? A lie that increases their own profits??
         | How dare you!
        
           | Animats wrote:
           | While lobbying for Government funding for 5G, too.[1][2]
           | 
           | [1] https://www.csis.org/analysis/accelerating-5g-united-
           | states
           | 
           | [2] https://thehill.com/business-a-lobbying/business-a-
           | lobbying/...
        
         | mikeryan wrote:
         | In theory yes? But 5G deployment is still catching up to LTE so
         | It's still going to be dependent on how saturated the bandwidth
         | is. I've found that in some crowded situations (conferences and
         | the ilk) switching to LTE actually performs better.
        
         | PhilippGille wrote:
         | I'm interested in more info about your client. Is it open
         | source, is there a website or blog post about it?
        
           | Animats wrote:
           | http://animats.com/sharpview/
        
       | kevin_nisbet wrote:
       | Taking a quick 5 minute look at the packet capture attached to
       | the post, it looks to me like this is likely traffic shaping.
       | While it's always difficult to be 100% sure from just the client
       | side capture, the capture looks relatively clean of errors, and
       | the amount of data in flight doesn't appear to even approach the
       | advertised window. We're getting some merging of segments likely
       | from a segment offload, but I doubt that's throwing off the
       | results.
       | 
       | So there's a good chance there's a shaper letting through about
       | 320kbit/s as it's relatively even throughout the capture.
        
         | acaloiar wrote:
         | Thanks for the feedback. I was hoping to see more of this sort
         | of analysis from the HN crowd :)
         | 
         | There's one other person from HN doing some analysis with me
         | via email. Maybe something will come of it. You both came to
         | the same conclusion based on the pcap data. They're also
         | analyzing the iphone tether pcap data I just provided in an
         | update.
        
       | fjni wrote:
       | > I already knew from previous experience that for some reason,
       | AT&T traffic to fast.com is throttled. Why AT&T wants bandwidth
       | to appear lower than reality is a mystery to me, but I digress
       | 
       | This I think is because they throttle ip addresses for known
       | video streaming sites. That is one of (the only reliable) ways an
       | ISP can get the streaming provider to drop the stream to a lower
       | quality one by default. Since fast.com is a Netflix ip, and the
       | isp can't distinguish whether it's video that is being
       | transferred or a file to measure throughout, the speed test gets
       | caught up in it. Said the other way around: fast.com is great to
       | see actual throughput from Netflix as opposed to some fake
       | throughout from a dedicated speed test site for the exact same
       | reason.
        
         | bscphil wrote:
         | > Since fast.com is a Netflix ip, and the isp can't distinguish
         | whether it's video that is being transferred or a file to
         | measure throughout,
         | 
         | It is _really_ trivial to do basic traffic snooping and see
         | what people are looking at. I 'm surprised it isn't more
         | common.
         | 
         | I figured it would be harder, or perform worse, but I easily
         | wrote a little piece of software that filters the TLS
         | ClientHello for arbitrary domains. Maybe 10 years ago hardware
         | wouldn't have been able to do this, but I bet it's no big deal
         | now. So your filter chain just looks like <Netflix IP range> ->
         | <has fast.com ClientHello> -> unthrottle. You don't need to do
         | packet inspection on every packet, just ones that you might be
         | interested in (e.g. Netflix IPs).
         | 
         | It's crazy to me that the many people who care about privacy
         | and censorship in tech haven't pushed ECH (encrypted
         | ClientHello) harder. It's such a gaping hole in web privacy
         | that you can still passively snoop domain names sent in
         | cleartext. It makes DoH/DoT almost pointless.
        
           | hedora wrote:
           | People drastically overestimate the security properties of
           | TLS.
           | 
           | The correct mental model is that it's good enough to convince
           | 1990's US internet users to type their credit card into a web
           | page. (Where the downside of a breach is that you have to
           | dispute some charges and change your CC#.)
           | 
           | If you need stronger security than that, then many, many
           | caveats start to apply.
           | 
           | For instance, by default, anyone that can reliably man-in-
           | the-middle port 80 on your website can get an acme
           | certificate for your domain from a reputable certificate
           | authority.
        
           | xyzzy_plugh wrote:
           | This isn't applicable to fast.com as it simply makes requests
           | to Netflix's CDN from the frontend. Indistinguishable from
           | regular Netflix traffic.
        
             | bscphil wrote:
             | Good point, although you could still do logic like only
             | activating the throttle _after_ the customer visits
             | netflix.com. You can 't distinguish the CDN traffic, but
             | you can still tell what website is being viewed.
             | 
             | Incidentally, my speeds on fast.com are always terrible
             | (about 1/8 of what I get elsewhere), despite the fact that
             | I'm fairly confident it is not being throttled. That's
             | because the speed I see is >100 Mbps, which is like 4
             | Netflix UHD streams. Wouldn't be much point in throttling
             | to that speed, you'd want 10 Mbps _max_ , and less on
             | wireless.
        
               | the456gamer wrote:
               | then you might miss embedded clients, right?
        
         | paulddraper wrote:
         | Indeed that's the point of fast.com.... To measure the speed
         | from Netflix servers
        
         | avianlyric wrote:
         | > Said the other way around: fast.com is great to see actual
         | throughput from Netflix as opposed to some fake throughout from
         | a dedicated speed test site for the exact same reason.
         | 
         | Yup. This is pretty much the reason Netflix created fast.com.
         | They wanted a speed test service that couldn't be gamed by
         | ISPs. Many ISPs will prioritise traffic to know speed test
         | services (like Ookla's speedtest.net), making their services
         | appear faster than they're under more normal usage.
         | 
         | By placing fast.com on Netflix IPs, ISPs either have to
         | prioritise all Netflix traffic (which they're very unlikely to
         | do), or accept that fast.com is going to provide a more
         | realistic measurement of their performance.
        
           | anonymousnotme wrote:
           | It definitely looks like testing sites are prioritized. The
           | fastest download speed that I have gotten is maybe 7 MB
           | (bytes) per second; generally it is 2-5 MB per second. The
           | speed test sites generally get 100 Mb per second dowload. In
           | general the best I seem to get is about half the speed of the
           | speed test sites. To me the real speed of the ISP is how fast
           | one can download something one wants, not the result of a
           | test. I would prefer to see results for downloads/uploads
           | from youtube and various CDN networks and popular sites. I
           | would also like to see ISP have a URL that is inside their
           | network to test upload and download so that one can at least
           | isolate what part of the connection might be lagging.
           | Actually, I just used devtools to snag a 25MB file from
           | fast.com. Curl/wget gives a speed of about 3 or 4 MB per
           | second. That does not really seem to match up with fast.com
           | download speed of 70Mb/second. 70/8 is 8.75, which is about
           | double. Is fast.com accurate? Is my math wrong?
        
             | jackson1442 wrote:
             | I personally like https://speed.cloudflare.com since it
             | just looks like you're doing typical CloudFlare traffic.
             | The results viewer is also quite nice.
        
           | neurostimulant wrote:
           | Now that my ISP bundles Netflix subscription into their
           | internet plans, access to netflix and fast.com now
           | practically saturate the fiber link, while before it was
           | outright blocked. Hooray for no net neutrality I guess.
           | 
           | Another fun part: when netflix IPs was blocked by this ISP,
           | it's pretty much impossible to use netflix because the only
           | way to get around the block was to use VPN, but netflix
           | itself blocks VPN access.
        
             | dspillett wrote:
             | _> Now that my ISP bundles Netflix subscription into their
             | internet plans, access to netflix and fast.com now
             | practically saturate the fiber link_
             | 
             | They may have an ISP-local netflix cache, from Netflix
             | themselves not some home-grown hack, so they can achieve
             | that with some reliability without it costing as much as it
             | otherwise would for bandwidth peering.
        
               | [deleted]
        
             | patmcc wrote:
             | Your ISP _entirely blocked_ netflix? That 's incredible
             | shitty.
        
               | baby wrote:
               | Heh, just revert back to pirating. That's what I do
               | whenever things don't work.
        
               | dhosek wrote:
               | Early in the pandemic, I spent a while without wired
               | internet using a wireless hotspot from the library which
               | would _not_ connect to Netflix but any other streaming
               | video service was fine. I forget who the wireless vendor
               | behind the hotspot was--I think it might have been
               | Verizon.
        
             | solarpunk wrote:
             | I'm curious where you live and what provider does this
             | weird Netflix reselling practice.
        
             | happymellon wrote:
             | > Hooray for no net neutrality I guess
             | 
             | Surely it would essentially saturate your fibre if there
             | was net neutrality, unless you don't pay for full fibre
             | speeds?
        
               | tpxl wrote:
               | Parent was being facetious.
        
             | bee_rider wrote:
             | What is the internet anyway? Are there truth in advertising
             | issues around selling internet access with excessive
             | filtering?
        
           | kijiki wrote:
           | Couldn't ISPs just sniff the SNI hostname to differentiate
           | fast.com vs actual Netflix video streaming?
        
             | wtallis wrote:
             | The fast.com page kicks off requests to nflxvideo.net
             | domains for the actual speed measurement. And it wouldn't
             | surprise me if actual Netflix video streaming made
             | occasional connections to fast.com purely to make it harder
             | for ISPs to cheat.
        
             | cesarb wrote:
             | You can think of the requests to fast.com as just loading
             | the speed test control scripts and user interface. The
             | actual speed test loads files from the same servers (with
             | the same SNI hostname) used by actual Netflix video
             | streaming. It wouldn't surprise me at all if the fast.com
             | speed test loads _real_ streaming video segments from these
             | servers, the only difference being that it doesn 't have
             | the decryption key for these videos.
        
               | therein wrote:
               | That's surely how I would have done it.
        
           | sharkski wrote:
           | [dead]
        
         | eurleif wrote:
         | I recently discovered that T-Mobile does this too, but they
         | actually let you disable it on their site. Ostensibly, it's a
         | feature for your benefit (somehow), and they're doing you a
         | favor by enabling it by default. In reality, of course, it's
         | for their own benefit, and they're banking on people not
         | realizing it can be disabled. I suppose giving you the option
         | lets them advertise things like "no throttling" and "4K
         | streaming supported" while still reaping the benefits of
         | throttling/lower-bitrate streaming.
        
           | tyingq wrote:
           | >it's a feature for your benefit (somehow)
           | 
           | They don't count the "shaped/throttled" sites against your
           | data plan limits, so I can see some people liking it.
        
             | eurleif wrote:
             | They do this even with an unlimited plan.
        
       | getpost wrote:
       | "Modernizing its search engine has become an obsession at
       | Google"....
       | 
       | No doubt it can be modernized, but just making Google search as
       | good as it used to be would be helpful. And why not better than
       | it used to be with the traditional interface? That would still be
       | worth doing even if Google adds on a superb AI.
       | 
       | Search is the proverbial goose that laid the golden egg and
       | Google is killing it, and I don't mean "killing" in the
       | contemporary ironic usage.
        
         | ikurei wrote:
         | I think you might have written this comment on the wrong post
        
         | delecti wrote:
         | Google search can't be as good as it used to, because the web
         | isn't as "clean" (pure? idealistic? honest? legitimate?) as it
         | used to be. People making websites with the goal of appearing
         | higher in Google's results means Google has to work on
         | countermeasures. That sets off a game of cat-and-mouse, and
         | means actual good results are caught in the crossfire.
        
         | thatguy0900 wrote:
         | Is it possible to return Google to pre-seo blackhat days? I
         | think the golden egg has been poisoned, even if Google tried
         | it's best
        
         | Flammy wrote:
         | Wrong thread?
        
       | ehPReth wrote:
       | Bell in Canada is doing the same with their new 'unlimited' (vs
       | the previous generation 'unlimited') and their cheaper data
       | plans.
       | 
       | Even if you have any amount of 'fast data' left you're throttled
       | to SD speeds for streaming video unless you pay for the higher
       | tier of their plans. Data isn't equal any more. Their higher
       | plans say "HD video is up to 1080p" so I suppose no
       | 1440p/4K/60fps/etc either.
       | 
       | It's honestly fucking infuriating but there's nothing that can be
       | done except use a VPN I guess. I'm on the previous generation so
       | "data is data" and they don't throttle me yet but if I ever
       | change plans it's there.
       | 
       | I'm not totally sure if the other carriers do (or their
       | 'competition' in forms of MVNOs that they themselves own) but
       | they tend to have a habit of copying each other, at least after a
       | little delay.
       | 
       | https://www.bell.ca/Mobility/Cell_phone_plans/Unlimited-plan...
       | (select your local area or just choose Ontario)
       | 
       | bonus fun bs:
       | 
       | every so often when you try to log into the web portal they try
       | to trick you into letting them build a profile off your
       | browsing/usage data so they can make even more money off of you.
       | a popup with 'advertising is a reality in today's world' comes up
       | with the nice attractive 'get this out of my face so I can do
       | things' blue button being 'yes please opt me in'. shady dark
       | pattern!
       | 
       | back when, they used to opt people in by default and make you
       | explicitly opt out... but then the regulators said hey that's
       | illegal. so now they resort to stuff like that to get the numbers
       | back up.
       | 
       | here's some of the blurb if anyone is interested: "Advertising is
       | a reality in today's world, and people find that they receive ads
       | that are irrelevant to them. With our tailored marketing program,
       | Bell will work to ensure that the offers participants receive
       | when using our services may be more relevant, rather than random
       | marketing ads. In other words, participants won't see more ads,
       | just more relevant ads."
       | 
       | full text: https://pastebin.com/ESskYEUy it's honestly super
       | gross what they collect and how they try to trick people into
       | agreeing.
        
       | lopkeny12ko wrote:
       | While everyone knows that all wireless carriers are universally
       | terrible, I've actually had a fairly noneventful (read: good)
       | experience with T-Mobile over the last decade. I've never
       | observed evidence of traffic shaping or any other shady business
       | (like capturing NXDOMAIN DNS responses and directing you to a
       | sponsored search page). I've also never observed significant
       | performance degradation from congestion-based prioritization
       | after exceeding the alloted 50 GB or whatever of monthly "normal-
       | priority" data usage.
        
         | jlund-molfese wrote:
         | I have too, mostly...
         | 
         | But apart from all the data breaches, I was also able to verify
         | T-Mobile doing this (arbitrary blocking of texts containing
         | innocuous URLs) on my plan. Although they _seem_ to have fixed
         | it now. https://news.ycombinator.com/item?id=29744347
        
         | canes123456 wrote:
         | Many of their plans downscale video, or at least they used to
        
           | artogahr wrote:
           | This is interesting, I don't see how this is possible from a
           | technical sense
        
             | ikiris wrote:
             | its trivial with a simple rate limit.
        
             | pjc50 wrote:
             | Identify (by IP or traffic shape) video traffic, then
             | throttle the stream to the desired bitrate. The viewer's
             | player will usually silently adapt.
        
             | justsomehnguy wrote:
             | Netflix should have it own set of AS. And after that it's
             | quite simple, routers can do throttle for decades.
        
             | dylan604 wrote:
             | If it is an HLS or DASH type of video stream, they could
             | just query the playlist for a smaller video size and
             | throttle that connection so that you're only served the
             | smaller encode vs the full frame highest quality. Pretty
             | simple thing to do really
        
           | lopkeny12ko wrote:
           | I've never experienced this. How would this even work for
           | encrypted (HTTPS) streams?
           | 
           | Even if this were technically feasible, it sounds like a
           | massive infrastructure investment with little to no value.
           | T-Mobile would need to have enough compute and network
           | horsepower to DPI all outbound traffic, intercept every video
           | stream, detect if it's over some resolution threshold, and
           | re-encode it at a lower resolution or bit rate, all in real
           | time.
        
             | sodality2 wrote:
             | Throttle video CDN ISP/ASN's
        
             | dghlsakjg wrote:
             | It is in collaboration with certain video providers.
             | 
             | YouTube over mobile for me is downscaled to 720p. In
             | exchange, that doesn't get counted in my high speed
             | allotment of data.
             | 
             | I can opt out, but then my data can get deprioritized over
             | a certain threshold.
        
           | dghlsakjg wrote:
           | On my older plan, they downscale video from some providers to
           | 720, but don't include that video in my data count.
           | 
           | I can opt out, but then any streaming goes against my high
           | speed data limit.
           | 
           | I think it's actually a pretty fair trade off.
        
         | survirtual wrote:
         | Yeah, except they leak customer data regularly and have
         | offshored tons of customer service to India -- including
         | onboarding. When I tried to sign up, they didn't know what an
         | esim was and wanted my SSN, along with other data that could
         | easily be used to steal my identity. I don't want to spend my
         | days arguing with people, definitely not about the existence of
         | esim; but I did that day. It went all the way up their customer
         | service management chain.
         | 
         | T-Mobile is also completely hit or miss with service. If you
         | are in a location where it works, fine. Good luck if you
         | travel.
         | 
         | If you can tolerate T-Mobile, Google Fi is better in almost
         | every way security wise -- and I am very anti-google services
         | these days. It uses the T-Mobile network.
         | 
         | As for me? ATT has provided the best service of any carrier
         | while traveling, so I will use them. When I need security, I
         | flip on my VPN.
        
           | quanticle wrote:
           | ATT has provided the best service of any carrier while
           | traveling, so I will use them.
           | 
           | Really? My experience with AT&T while traveling has been
           | pretty awful. In the US, in rural areas, Verizon is better.
           | And outside the US, Google Fi gives you international data
           | roaming as part of the base package. One of the reasons I
           | switched to Google Fi is because it's so much better when
           | traveling.
        
             | jen20 wrote:
             | I used Google Fi for a while, and while I'd love to use
             | them as a primary carrier again, I can't until they choose
             | to support add-on SIMs for watches. As a Google Fi and
             | YoutubeTV customer, I cannot wait until I no longer have to
             | give AT&T any money at all.
        
               | judge2020 wrote:
               | The only thing with Fi is that it is T-Mobile, and you'll
               | always be in a lower priority block of customers compared
               | to people paying for T-Mobile directly, which mean you'll
               | see slower traffic in congested areas at peak times
               | (including e.g. during rush hour traffic).
        
               | radicaldreamer wrote:
               | Thats not true, Google Fi has the same priority as
               | postpaid T-Mobile. This is something MVNOs negotiate in
               | their contracts with carriers, not something thats true
               | across the board.
               | 
               | Discount MVNOs increase their margins by buying wholesale
               | deprioritized data while Google Fi has negotiated the no
               | deprioritization.
        
               | judge2020 wrote:
               | Is this talked about somewhere? All I see is this reddit
               | post[0] by u/Peterfield53, which looks like a very active
               | user on r/GoogleFi but doesn't seem to be a Googler or
               | otherwise a Google Fi support agent.
               | 
               | 0: https://old.reddit.com/r/GoogleFi/comments/ulc1t5/perk
               | s_of_f...
        
               | [deleted]
        
               | horsawlarway wrote:
               | If you're travelling, I find it hard to beat Fi.
               | 
               | You literally land in a new country, turn your phone back
               | on and you get a "Welcome to [country] - your data rate
               | is the same" message almost anywhere.
               | 
               | Personally - I've flown from Taiwan to Brazil to
               | Amsterdam and then back to the US and I don't have to
               | think about my phone. It just works.
               | 
               | ---
               | 
               | Outside of the travel use-case, I would also probably
               | pick something else, but if I know I'm going to be
               | travelling, I'll switch back to Fi.
        
               | zamnos wrote:
               | With eSim and the Airalo app, international travel is
               | fairly painless. It costs a few bucks and a couple
               | minutes to setup (which can be done while waiting at the
               | airport to leave) to get a data-only sim for your
               | destination county. If you're paying for an expensive
               | domestic account for international reasons instead of a
               | cheaper $40/mo eg Mint mobile plan, it might be worth
               | investigating theirs plans to see if it would end up
               | saving money, given your travel requirements.
        
               | withinboredom wrote:
               | I still have my Sprint plan. This is how it works by
               | default. (Sprint + gvoice = google fi; before gfi you
               | could merge your gvoice and sprint accounts which was
               | really cool. Then they cancelled that and started gfi)
               | Since the TMo merger, I suspect gfi is still using the
               | Sprint stuff.
        
           | toomuchtodo wrote:
           | If I have to pick between T-Mobile and Google, I pick
           | T-Mobile. Google is going to kill Fi and Voice one day,
           | T-Mobile is not. T-Mobile has some customer service,
           | including stores, Google has none. Was able to migrate a
           | physical SIM to an eSIM in a store in ~30 min. You can even
           | move your Google Voice number to a T-Mobile DIGITS number for
           | similar functionality.
           | 
           | (T-Mobile customer for 2+ decades, least terrible option
           | imho)
           | 
           | EDIT: > Google Voice app may be slow but it does work every
           | time
           | 
           | Until it doesn't! Fair critique though. I can also recommend
           | the "Unlisted" iOS app for this purpose.
        
             | dmitrygr wrote:
             | > You can even move your Google Voice number to a T-Mobile
             | DIGITS number for similar functionalit
             | 
             | You had my interest...till i read the reviews of the DIGITS
             | app on the app store. 1.9 average, most complains about it
             | not working at all. Google Voice app may be slow but it
             | does work every time
        
           | manuelabeledo wrote:
           | > As for me? ATT has provided the best service of any carrier
           | while traveling, so I will use them.
           | 
           | I'm curious about your reasons to say that AT&T provides the
           | best service "while traveling". I'm guessing it would be
           | domestic travel, because AT&T roaming charges are the second
           | highest among the big three (I believe Verizon is actually
           | even more expensive).
           | 
           | I was a customer and an employee of AT&T for a while, and I
           | find T-Mobile to be better in almost every aspect, except
           | perhaps for coverage in very rural areas, which I don't mind.
           | T-Mobile 5G coverage and speed is also significantly better.
        
             | lotsofpulp wrote:
             | Do you mean international charges? I thought roaming has
             | not been a thing for a decade.
             | 
             | Many ATT plans include usage in all of the western
             | hemisphere, excluding the Caribbean islands. And for
             | countries not included, it is $10 per day ($5 for other
             | lines on your plan) up to 10 days in a billing cycle, and
             | after that it is free until the next billing cycle.
             | 
             | Not the cheapest (I think T-Mobile has international at $5
             | per day), but not terrible either for a quick jaunt
             | somewhere and not having to worry about SIMs or changing
             | phone number or whatever.
        
           | hypothesis wrote:
           | > If you can tolerate T-Mobile, Google Fi is better in almost
           | every way security wise -- and I am very anti-google services
           | these days. It uses the T-Mobile network.
           | 
           | Be careful there, because T-Mobile rot spreads to any
           | downstream MNVO. Sim-jacking is still possible and data
           | breach is happening above Google Fi level. There were
           | articles about that IIRC.
        
       | rsaxvc wrote:
       | When I had AT&T VDSL they had weak peering. Some traffic that
       | should have gone across town would routinely get routed several
       | states away before coming back to town, because they hadn't
       | peered with the local exchanges. Some traffic was ok.
       | 
       | When I switched to an ISP with local peering, ping times between
       | my home and my server downtown dropped to a few milliseconds.
       | It's like being on my LAN.
       | 
       | If this is still an issue for AT&T, traceroute+reverse DNS of
       | each router may indicate it.
       | 
       | This poor peering isn't directly a throughput problem, but really
       | increases the chance of being routed through a congested link,
       | which you could sometimes guestimate from ping times and
       | peeringdb.
        
         | Scoundreller wrote:
         | Same issue in Canada: our big ISPs historically refuse to peer
         | freely at our domestic IXs like TORIX. So smaller ISP and DCs
         | end up peering with them in the USA and your packets would make
         | circuitous cross-border round trips to go a few km.
         | 
         | Some national players do have ports at domestic IXs, but only
         | as backup links or for negotiated (paid?) access.
         | 
         | The hazards of ISPs also being backbone providers.
         | 
         | (It looks like Rogers has gotten better with this behaviour)
        
         | jshier wrote:
         | Yep. I'm still on AT&T's ADSL (what used to be known as Uverse)
         | and routinely get routed through Chicago rather than Detroit (I
         | live 30 mi north) for major services like Cloudflare. Of the
         | two choices I have for ISP, AT&T or Comcast, only AT&T has such
         | poor routing. AT&T Fiber apparently has better peering but
         | their supposed expansion hasn't happened in my area yet.
        
       | chrsjxn wrote:
       | You've got to love a website that makes text selection invisible
       | by default.
       | 
       | I'd probably double check assumptions on the cloudfront issues.
       | Switching carriers or adding VPN might connect you to a different
       | edge node.
       | 
       | Some web assets being throttled for specific AT&T accounts seems
       | a little too targeted to just be traffic shaping. I'd expect them
       | to throttle traffic for all users, like they do with the speed
       | tests.
        
         | sgtfrankieboy wrote:
         | >You've got to love a website that makes text selection
         | invisible by default.
         | 
         | First time seeing it being invisible, mostly they just disable
         | it. Terribly annoying practice. I often select text while
         | reading articles.
        
           | chrsjxn wrote:
           | Same here!
           | 
           | I think it helps me read faster online, but it's probably
           | just a fidget-y habit.
        
       | 0887437208577 wrote:
       | [flagged]
        
       | esalman wrote:
       | Fun story: I work remotely for an org located in the Bay area.
       | Few months ago I get a call early morning from the IT security
       | person. Apparently someone had been trying to RDP into my work
       | laptop, over a thousand attempts per day for last couple of days.
       | 
       | What changed before the last couple of days? My laptop was
       | frequently dropping WiFi connection- a lot of times in the middle
       | of zoom meetings. We use a router provided by AT&T. My wife
       | complained of the same thing, so I thought I'll ping their
       | customer support.
       | 
       | The customer support person proceeded to tell us they wanted to
       | reconfigure our router to enable "5G". After some bewilderment we
       | realized they were talking about 2.4G vs. 5G WiFi. And they will
       | do it remotely. Ok fine go ahead, we said, and forgot about it..
       | until I got the call from my office IT security.
       | 
       | Apparently the AT&T support person left our router in passthrough
       | mode. According to their K/B, "Placing a device in passthrough
       | mode will remove firewall protection provided by the AT&T
       | gateway."
       | 
       | I reset my router to default settings, and got myself a 100ft
       | Ethernet cable to fix the issues.
        
         | LoganDark wrote:
         | > Placing a device in passthrough mode will remove firewall
         | protection provided by the AT&T gateway
         | 
         | Did... did they seriously turn the router into a DMZ*, without
         | your consent? Where every port of your computer is just open to
         | the internet?
         | 
         | That's scary.
         | 
         | *that's what it was called on my router, the "forward every
         | single port to one device" mode. Not sure if that is the
         | correct term for it.
        
           | esalman wrote:
           | Yeah. We checked with censys.io, port 3389 and 8080 were open
           | as publicly available service on the router.
        
           | rzzzt wrote:
           | Passthrough mode turns ~90% of the (DSL modem / ONT) + router
           | + DHCP + NAT + WiFi AP + whatever functionality off, allowing
           | you to add another home router after it which is completely
           | under your control and let the ISP-provided one only do the
           | most necessary, eg. (DSL modem / ONT) parts.
        
             | judge2020 wrote:
             | At least on BGW-320's, which are the modern routers for ATT
             | fiber deployments, it keeps flows in the NAT table even if
             | you use it in passthrough mode, although it doesn't
             | actually do NAT, so you end up still being limited to 8192
             | sessions (not that that's typically a problem, but it does
             | mean you can't e.g. run a big web server through your
             | connection, and you can't use 3p fiber modems without some
             | hacks).
        
             | LoganDark wrote:
             | > add another home router after it which is completely
             | under your control and let the ISP-provided one only do the
             | most necessary, eg. (DSL modem / ONT) parts.
             | 
             | Oh absolutely, I used that trick once in order to use a
             | router that I could configure over web interface instead of
             | Over The Cloud With A Spyware Mobile App (aka Internet Of
             | Shit).
             | 
             | Unfortunately my ISP smartened up to this and started
             | cutting the line whenever I tried to use my router. Like,
             | it would work for a while, then they'd shut off service,
             | and it wouldn't work anymore (even if I removed my router)
             | until I called them up and complained.
             | 
             | They would act oblivious like the problem was with my
             | equipment. Every time I asked them why my internet stopped
             | working they would say there was some problem with my
             | hardware. The hardware was brand new and could not have
             | been more fine; they were mistaken. It would also work
             | perfectly when I actually had service; the issue was the
             | ISP kept cutting it because they're petty bastards.
             | 
             | Eventually I gave up, which is probably what they wanted,
             | but it's not like I'm suffering too badly with their
             | equipment, even if I have to use a rooted phone in order to
             | pry away all the spyware permissions from their stupid app.
             | 
             | They are a monopoly so I have no choice.
        
               | alar44 wrote:
               | [dead]
        
               | radicaldreamer wrote:
               | You need to file an FCC complaint about this, Xfinity has
               | an executive response team for all FCC complaints.
               | Document every time you called them and your equipment
               | details.
        
               | avidiax wrote:
               | I had to do this when they let a new renter cancelled my
               | cable internet multiple weeks before my move-out, even
               | after I told them that the new renter's dates were wrong
               | when they called to confirm. Regular support wanted me to
               | sign a new contract and pay an install fee to reactivate.
               | 
               | It was a really shitty situation that should never have
               | happened, but the executive team was what all customer
               | service should strive to be. A single person, with ample
               | time in their day to fully understand the problem and
               | blow past all the usual roadblocks on the way to a
               | solution. Was still a few hours on the phone, but at
               | least I wasn't treated as though it was my fault.
        
               | LoganDark wrote:
               | Honestly, that experience was years ago, and I don't
               | really care enough to raise a fuss about it just today,
               | since their first-party router is "not too terrible".
               | 
               | About Xfinity in particular though, assuming someone else
               | uses them, I did learn just recently that at least
               | Xfinity allegedly offers a special decoder box (or
               | something) that is, I believe, free of charge, and lets
               | you hook up your router directly rather than putting it
               | through theirs as a DMZ, and it's supposed to get them to
               | not cut the line. Some self-install kit or something. You
               | can only get it by asking over phone call.
        
               | baobrien wrote:
               | I bought my own 3rd party cable modem for Xfinity and it
               | works fine.
        
               | LoganDark wrote:
               | Well, in my situation/ISP it did happen. Though it was a
               | while ago so I don't remember too many specifics.
        
               | bee_rider wrote:
               | Wow, I hate Comcast like everyone else, but even they are
               | not that bad. That is just ridiculous. If I couldn't have
               | my own modem and own router... I dunno, they have a local
               | monopoly, but I'd start looking at 5G connections or
               | something.
        
               | [deleted]
        
         | [deleted]
        
       | thorum wrote:
       | I noticed this same issue with my AT&T internet. After some
       | investigation, I found that using a VPN (Virtual Private Network)
       | effectively resolved the problem. It seems that when internet
       | traffic is encrypted and routed through a different server, the
       | traffic shaping technique they employ isn't able to identify and
       | throttle specific types of data.
        
       ___________________________________________________________________
       (page generated 2023-04-16 23:00 UTC)