News for hackers. Stuff that matters.

A comment on New phenomenon breaks inbound TCP policing.

Re:New phenomenon breaks inbound TCP policing by colanderman on Monday June 06, 2016 @10:34PM (#11852015)
Title is wrong; updates come over TCP that has been modified not to perform link sharing.

I have seen this with my wife's computer. Though I haven't seen the large-window phenomenon (haven't looked), what I do see is dozens of active connections opened to the same destination, which of course defeats both TCP's link sharing and standard QoS algorithms.

I work around the issue by bucketing any Akamai IP ranges I find into a very-low-priority queue, and let those TCP connections fight it out. Seems to have worked well.

For those interested, here are the Akamai IP ranges I use:

    23.0.0.0/12
    23.32.0.0/11
    23.64.0.0/14
    23.72.0.0/13
    104.64.0.0/10
    2001:428:4403::/48
    2001:428:4404::/48
    2001:428:4405::/48
    2001:428:4406::/48
    2600:1400::/24
[ Parent | on HN ]
Re:New phenomenon breaks inbound TCP policing by rhubarbquid on Monday June 06, 2016 @10:43PM (#11852049)
It's also not Windows 10 specific, the post also mentions Office updates
[ Parent | on HN ]
Re:New phenomenon breaks inbound TCP policing by JonathonW on Monday June 06, 2016 @11:08PM (#11852125)
There's a mention somewhere in the middle of the thread that someone had seen something similar with Apple's software updates, too: maybe it's a more general Akamai issue?

Even if it is isolated to the servers distributing MS's updates, I'm having trouble seeing how this could even be MS's fault-- it's the server side (owned and operated by Akamai) that's misbehaving here.

[ Parent | on HN ]
Re:New phenomenon breaks inbound TCP policing by colanderman on Monday June 06, 2016 @11:17PM (#11852147)
I'm not convinced either way. Windows Update is the one opening the dozens of connections (it has to if it's behind a firewall), not Akamai; Akamai's just serving the data. But Windows Update is possibly just calling out to an Akamai library that opens the dozens of connections on its behalf.

If there are also congestion-algorithm shenanigans like the forum post suggests, then Akamai is definitely at fault. But the issue I see is that of connection hogging.

[ Parent | on HN ]
Re:New phenomenon breaks inbound TCP policing by chopsywa on Tuesday June 07, 2016 @09:16AM (#11854229)
Apparently Apple has gone away from Akamai.
[ Parent | on HN ]
Re:New phenomenon breaks inbound TCP policing by chopsywa on Tuesday June 07, 2016 @09:15AM (#11854223)
Problem is that there are so many other non-Windows updates using Akamai. I blocked it on my site and immediately had complaints that the client could not access MSN.COM.
[ Parent | on HN ]
Re:New phenomenon breaks inbound TCP policing by colanderman on Tuesday June 07, 2016 @09:48AM (#11854452)
I don't block it; I just deprioritize it in my queueing policy. (I also limit it to about 2/3 of my total bandwidth, and apply RED to discourage bursts.)
[ Parent | on HN ]