yitz: It seems GitHub CDN has been removed from the DIA filter now.

??? It is nothing related to the DIA filter...

michaelmurfy:

 

I don't feel this is the DIA filter given it is not affecting other providers to the same extent.

 

As a Spark user I can reproduce the same issues to the same extent as those on 2degrees. I believe suspicion is being cast on the filter as all the problematic traces with packet loss pass through 124.150.165.62. Your trace via Quic does not seem to route via 124.150.165.62, or am I misreading it?

yitz: This will increase the number of blocked URLs from around 700 to up to 30,000 on any given day. The IWF filter is updated daily using both human analysis and artificial intelligence to identify webpages confirmed to host this illegal material. The Department is currently implementing the filter and expects to have it fully incorporated this year.

You may actually be onto something if they're rolling out on a progressive matter to monitor / prevent issues. So this may be the DIA filter but the packet loss appears to start before or at this IP:

- IP           124.150.165.62
- Anycast      false
- Hostname
- City         Sydney
- Region       New South Wales
- Country      Australia (AU)
- Currency     AUD ($)
- Location     -33.8678,151.2073
- Organization AS18407 Click Internet Limited
- Postal       1001
- Timezone     Australia/Sydney

I run a ripe measurement with just a simple ping test across NZ and get 2degrees and some Spark + Prodigi probes failing: https://atlas.ripe.net/measurements/86142704/overview

The Traceroute is less useful but happy to run a Traceroute across all NZ probes to confirm if it is potentially selective: https://atlas.ripe.net/measurements/86142633/

However unless if you're in the know I think it is best to not speculate. It is somewhat odd that traffic is heading out of NZ and ending up in Australia especially for Github Pages where there is a local CDN. It could be routing issues, it could be the DIA filter, we don't really know.

But as Prodigi is on the list perhaps I could summon @danfaulknor to see if they know anything.

It's quite well known that Fastcom is associated with the DIA filter, they even used to have a testimonial on their old website about it:
https://cdn.geekzone.co.nz/imagessubs/ea762e7f8f2ab74630d99357d3aeebe1.jpg

I'd presume the clean traffic goes out of Sydney by design because they don't want any routing fault that could develop in the system to bring down the domestic peering exchanges.

I doubt ISPs are allowed to comment about it openly, and especially the likes of 2degrees who recently became involved in schools' internet filtering so it would be a sensitive topic commercially. Anyway, it seems like there's been some action this afternoon which is a good sign.

@yitz Yeah fully agree. Historically some ISP's could comment if there was a mistake for example Cloudflare or another CDN being blocked but it's somewhat sensitive for pretty obvious reasons.

I still think we could speculate but I am also a little miffed by the packet loss occurring too so there may be something else going on.

I can confirm no more drops to pages.github.com...

But all the other reported sites still have issues..

My connection has been especially spotty today. Some GitHub stuff outright wasn't loading for a while, and a quick check on Imgur shows that it too is still excruciatingly slow to load.

I've been thinking about switching to Quic for a while, and this is certainly pushing me in that direction.

In the meantime, I just finished setting up SmokePing so I should be getting some of my own objective metrics soon enough.

Well, this is a new and weird one. Haven't seen this before when loading Imgur. It went away on a page refresh, but still a novel issue. I wonder if it's related to packet loss or something else?

jnimmo:

 

Out of interest, does disabling the `TLS 1.3 post-quantum key agreement` flag in Chrome fix the issue?

 

chrome://flags/#enable-tls13-kyber

 

Not using Chrome. Using Firefox..

And yes the problem occurs on Chrome too, but doesn't occur on none 2degrees ISPs.

I haven't been running SmokePing long at all, but already it's grim. Yikes.

ETA: imgur.com and i.imgur.com are likely to give different results as well. i.imgur.com goes to Fastly, but for some reason it's not going to any nearby POPs that Fastly would have.

openmedia:

jnimmo:

Out of interest, does disabling the `TLS 1.3 post-quantum key agreement` flag in Chrome fix the issue?

chrome://flags/#enable-tls13-kyber

Not using Chrome. Using Firefox..

 

And yes the problem occurs on Chrome too, but doesn't occur on none 2degrees ISPs.

jnimmo:

openmedia:

 

Not using Chrome. Using Firefox..

 

 

 

And yes the problem occurs on Chrome too, but doesn't occur on none 2degrees ISPs.

 

I believe the Firefox flag is TLS 1.3 hybridized kyber support.

The fact we're seeing issues with traceroute and mtr would indicate it is a lot more than TLS 1.3