General Virgin Akamai Cache Congestion - Page 3

Robertus · 08-06-2021, 15:38

Quote:

Originally Posted by Synthetic

Easiest way to test - https://1.1.1.1/help

Yes i'll post my finding over there too

Do you know of any good guides to install cloudflared on a synology NAS running docker and pihole?

Also thanks for posting.

Skie · 08-06-2021, 21:33

The DNS hijacking is probably also how they enforce blocking of websites for IWF and High Court orders.

Once browsers and OS's begin enabling more secure DNS lookups by default that might get fun.

Synthetic · 09-06-2021, 07:01

Quote:

Originally Posted by Robertus

Do you know of any good guides to install cloudflared on a synology NAS running docker and pihole?

Also thanks for posting.

Just the guides on the pihole wiki, it covers various architectures, as long as you have some kind of cli access you should be able to configure it

https://docs.pi-hole.net/guides/dns/cloudflared/

---------- Post added at 07:01 ---------- Previous post was at 06:51 ----------

Quote:

Originally Posted by Skie

The DNS hijacking is probably also how they enforce blocking of websites for IWF and High Court orders.

Once browsers and OS's begin enabling more secure DNS lookups by default that might get fun.

Had a quick look,

Looks like Virgin are blocking those at the network level via IP, all of the below addresses take me to a virgin blocked page, slightly worrying as those are some of cloudflare's anycast IPs so they're probably blocking some sites they shouldnt be that are behind cloudflare...

; <<>> DiG 9.16.1-Ubuntu <<>> iptorrents.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16734
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;iptorrents.com. IN A

;; ANSWER SECTION:
iptorrents.com. 81 IN A 104.20.222.73
iptorrents.com. 81 IN A 104.20.223.73
iptorrents.com. 81 IN A 172.67.3.170

Robertus · 10-06-2021, 15:18

So, I have installed Adguard home and pointed my apple tv and PC to it - using DoH etc, BT seems OK however Nowtv is still crap.

Have you seen this behaviour?

https://imgur.com/ZcUj2e1

Synthetic · 11-06-2021, 08:54

Quote:

Originally Posted by Robertus

So, I have installed Adguard home and pointed my apple tv and PC to it - using DoH etc, BT seems OK however Nowtv is still crap.

Have you seen this behaviour?

https://imgur.com/ZcUj2e1

Not personally, in my testing i found nowtv uses

linear014-gb-hss1-prd-ak.cdn.skycdp.com
and
linear019-gb-hss1-prd-ak.cdn.skycdp.com

for live streaming.

If you do a ping / tracert to those, what IPs do they come back to?

General Maximus · 11-06-2021, 08:59

C:\WINDOWS\system32>tracert linear014-gb-hss1-prd-ak.cdn.skycdp.com

Tracing route to a1792.w60.akamai.net [176.255.191.144]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms router.asus.com [18.19.1.1]
2 10 ms 8 ms 9 ms 10.53.39.129
3 9 ms 9 ms 10 ms nott-core-2a-xe-1013-0.network.virginmedia.net [62.255.214.129]
4 * * * Request timed out.
5 * * * Request timed out.
6 13 ms 14 ms 17 ms tcma5-ic-1-ae0-0.network.virginmedia.net [62.253.174.181]
7 13 ms 12 ms 13 ms cur1-runc2-0-0-cust2.1-3.cable.virginm.net [213.105.20.3]
8 * * * Request timed out.
9 11 ms 13 ms 10 ms host16-rangeF-mcdn.cdn.enlba.isp.sky.com [176.255.191.144]

C:\WINDOWS\system32>tracert linear019-gb-hss1-prd-ak.cdn.skycdp.com

Tracing route to a1931.w60.akamai.net [176.255.191.139]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms router.asus.com [18.19.1.1]
2 34 ms 23 ms 18 ms 10.53.39.129
3 45 ms 41 ms 33 ms nott-core-2a-xe-013-0.network.virginmedia.net [62.254.0.153]
4 * * * Request timed out.
5 * * * Request timed out.
6 100 ms 215 ms 184 ms tcma5-ic-1-ae0-0.network.virginmedia.net [62.253.174.181]
7 29 ms 41 ms 72 ms cur1-runc2-0-0-cust2.1-3.cable.virginm.net [213.105.20.3]
8 * * * Request timed out.
9 13 ms 12 ms 10 ms host11-rangeF-mcdn.cdn.enlba.isp.sky.com [176.255.191.139]

Synthetic · 11-06-2021, 09:46

So i get a totally different IP Range, and take a much longer route...

Tracing route to a1792.w60.akamai.net [88.221.210.11]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.88.1
2 12 ms 13 ms 10 ms 10.53.34.249
3 15 ms 11 ms 9 ms gate-core-2a-xe-501-0.network.virginmedia.net [82.2.240.105]
4 * * * Request timed out.
5 * * * Request timed out.
6 24 ms 23 ms 22 ms 86.85-254-62.static.virginmediabusiness.co.uk [62.254.85.86]
7 * * * Request timed out.
8 25 ms 26 ms 25 ms uk-lon01c-ri2-ae-4-0.aorta.net [84.116.135.50]
9 23 ms 28 ms 21 ms ae-8.a02.londen12.uk.bb.gin.ntt.net [129.250.66.101]
10 26 ms 26 ms 25 ms ae-0.r20.londen12.uk.bb.gin.ntt.net [129.250.3.212]
11 30 ms 26 ms 29 ms ae-24.r00.mancen01.uk.bb.gin.ntt.net [129.250.4.190]
12 25 ms 24 ms 22 ms 212.119.4.98
13 44 ms 33 ms 25 ms r2.man-tcw.exa.net.uk [82.219.45.239]
14 26 ms 22 ms 22 ms r1.man-tcw.exa.net.uk [82.219.44.1]
15 24 ms 27 ms 31 ms r1.lon-the.exa.net.uk [82.219.45.29]
16 26 ms 25 ms 27 ms r2.lon-the.exa.net.uk [82.219.45.94]
17 55 ms 28 ms 30 ms r1.leeds-sc.exa.net.uk [82.219.2.46]
18 46 ms 52 ms 52 ms leeds-transit1.akamai.ce.exa.net.uk [82.219.2.93]
19 31 ms 31 ms 29 ms a88-221-210-11.deploy.static.akamaitechnologies.com [88.221.210.11]

General Maximus · 11-06-2021, 13:31

Quote:

Originally Posted by Synthetic

So i get a totally different IP Range, and take a much longer route

Well that is google dns and my kick ass Asus router for you :p

Skie · 11-06-2021, 20:16

I get yet another route

Tracing route to a1792.w60.akamai.net [2.22.22.210]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms USGGateway [192.168.1.1]
2 10 ms 10 ms 7 ms 10.53.39.21
3 13 ms 10 ms 10 ms pres-core-2b-xe-0011-0.network.virginmedia.net [62.255.65.125]
4 * * * Request timed out.
5 21 ms 21 ms 18 ms 86.85-254-62.static.virginmediabusiness.co.uk [62.254.85.86]
6 * * * Request timed out.
7 31 ms 19 ms 22 ms be2871.ccr42.lon13.atlas.cogentco.com [154.54.58.185]
8 58 ms 27 ms 27 ms be12489.ccr42.par01.atlas.cogentco.com [154.54.57.70]
9 36 ms 26 ms 24 ms be2103.ccr32.par04.atlas.cogentco.com [154.54.61.22]
10 29 ms 26 ms 25 ms be2151.agr21.par04.atlas.cogentco.com [154.54.61.34]
11 27 ms 27 ms 29 ms akamai.demarc.cogentco.com [149.11.114.234]
12 27 ms 29 ms 26 ms a2-22-22-210.deploy.static.akamaitechnologies.com [2.22.22.210]

Trace complete.

Synthetic · 12-06-2021, 16:13

Quote:

Originally Posted by Skie

I get yet another route

Tracing route to a1792.w60.akamai.net [2.22.22.210]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms USGGateway [192.168.1.1]
2 10 ms 10 ms 7 ms 10.53.39.21
3 13 ms 10 ms 10 ms pres-core-2b-xe-0011-0.network.virginmedia.net [62.255.65.125]
4 * * * Request timed out.
5 21 ms 21 ms 18 ms 86.85-254-62.static.virginmediabusiness.co.uk [62.254.85.86]
6 * * * Request timed out.
7 31 ms 19 ms 22 ms be2871.ccr42.lon13.atlas.cogentco.com [154.54.58.185]
8 58 ms 27 ms 27 ms be12489.ccr42.par01.atlas.cogentco.com [154.54.57.70]
9 36 ms 26 ms 24 ms be2103.ccr32.par04.atlas.cogentco.com [154.54.61.22]
10 29 ms 26 ms 25 ms be2151.agr21.par04.atlas.cogentco.com [154.54.61.34]
11 27 ms 27 ms 29 ms akamai.demarc.cogentco.com [149.11.114.234]
12 27 ms 29 ms 26 ms a2-22-22-210.deploy.static.akamaitechnologies.com [2.22.22.210]

Trace complete.

Interesting, I'm sure that's the IP / route I was seeing when I first had issues..

InsaneNutter · 16-06-2021, 12:07

Interestingly enough I've been having issues with the BBC iPlayer constantly buffering every 30-60 seconds for a couple of weeks now.

I've enabled DoT on pfSense which certainly seems to stop me hitting Virgins Akamai caches, I'll have to watch something on the iPlayer tonight and see how things are.

Synthetic · 16-06-2021, 15:01

Quote:

Originally Posted by InsaneNutter

Interestingly enough I've been having issues with the BBC iPlayer constantly buffering every 30-60 seconds for a couple of weeks now.

I've enabled DoT on pfSense which certainly seems to stop me hitting Virgins Akamai caches, I'll have to watch something on the iPlayer tonight and see how things are.

It's cropped up on reddit, enabling DoH / DoT has sorted it there as well.

cje85 · 17-06-2021, 10:08

Quote:

Originally Posted by Synthetic

So i get a totally different IP Range, and take a much longer route...

Tracing route to a1792.w60.akamai.net [88.221.210.11]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.88.1
2 12 ms 13 ms 10 ms 10.53.34.249
3 15 ms 11 ms 9 ms gate-core-2a-xe-501-0.network.virginmedia.net [82.2.240.105]
4 * * * Request timed out.
5 * * * Request timed out.
6 24 ms 23 ms 22 ms 86.85-254-62.static.virginmediabusiness.co.uk [62.254.85.86]
7 * * * Request timed out.
8 25 ms 26 ms 25 ms uk-lon01c-ri2-ae-4-0.aorta.net [84.116.135.50]
9 23 ms 28 ms 21 ms ae-8.a02.londen12.uk.bb.gin.ntt.net [129.250.66.101]
10 26 ms 26 ms 25 ms ae-0.r20.londen12.uk.bb.gin.ntt.net [129.250.3.212]
11 30 ms 26 ms 29 ms ae-24.r00.mancen01.uk.bb.gin.ntt.net [129.250.4.190]
12 25 ms 24 ms 22 ms 212.119.4.98
13 44 ms 33 ms 25 ms r2.man-tcw.exa.net.uk [82.219.45.239]
14 26 ms 22 ms 22 ms r1.man-tcw.exa.net.uk [82.219.44.1]
15 24 ms 27 ms 31 ms r1.lon-the.exa.net.uk [82.219.45.29]
16 26 ms 25 ms 27 ms r2.lon-the.exa.net.uk [82.219.45.94]
17 55 ms 28 ms 30 ms r1.leeds-sc.exa.net.uk [82.219.2.46]
18 46 ms 52 ms 52 ms leeds-transit1.akamai.ce.exa.net.uk [82.219.2.93]
19 31 ms 31 ms 29 ms a88-221-210-11.deploy.static.akamaitechnologies.com [88.221.210.11]

Is that using 1.1.1.1 DNS? I always found it had poor routing to CDNs including Akamai, compared to Google DNS.

Synthetic · 17-06-2021, 14:27

Quote:

Originally Posted by cje85

Is that using 1.1.1.1 DNS? I always found it had poor routing to CDNs including Akamai, compared to Google DNS.

Nah i'm now running my own local unbound server and resolving stuff myself, although i'd expect cloudflare / google to resolve hostnames to the same IP

heero_yuy · 17-06-2021, 14:44

This is what I get using Google's DNS

Pretty slick.

akamai.net.JPG