5 ms·

I love these debugging stories but its a total nightmare to deal with these kinds of issues. At the moment there's this really weird network issue we're having

I love these debugging stories but its a total nightmare to deal with these kinds of issues. At the moment there's this really weird network issue we're having where iPhones are unable to play Netflix on the Wifi. Every other device works fine but iphone 7, 8 (2 devices) and SE can't stream Netflix. I noticed there is other things they can't do, for example the page for the fast.com speedtest loads but the speedtest cant be performed. Same with the Google speedtest. The phones also can't access Apples update server on the wifi. Other network stuff does work fine, youtube works, browsing works, etc. The behaviour is consistent across the iphones and all these things work fine on multiple other devices on the same network. I can't make sense of it at all. Called internet provider and they didnt know either apparently other people had the same issue but nothing has changed from their side of things. Called Apple support and they are putting the blame on the network provider. Tested one of the devices on a different wifi network and works fine. AFAIK if you're an internet router the packets look the same no matter what device is being used so I think this must be some Apple software issue. Or maybe my router is cursed.

mrb 4y ago
I'm fairly confident you are victim of a PMTUD black hole. It's easily fixed by making your router force the TCP MSS to a slightly lower value. All your symptoms are explained by this (some but not all devices are affected, some but not all services are unreachable).
- kalleboo 4y ago
  Yeah, not having an option to set the MTU was the reason I had to stop using the Apple AirPort Extreme when we moved to a new apartment, the symptoms were all the same as GP, limiting the MTU fixed it.
- cryptonector 4y ago
  Or better yet, use packetization PMTUD. 15 years after that was published by the IETF, every device should implement it by default.
  - toast0 4y ago
    Apple is actually pretty good about PMTUD as a sender, at least iPhones (but I assume Macs too) will quickly fallback to sending shorter packets if they don't get an ack with a large packet at the beginning of a TCP connection. I'd guess they do it throughout the connection, but I only saw it because network was broken, pcaps from iPhone show working connection, pcaps from Android show broken connection. It doesn't help that FreeBSD used to do MSS sensibly (thanks to a patch from Microsoft), and switched to doing it the way everyone else does. There's not a good reason to send your naive MSS on SYN+ACK if it's bigger than the received MSS, it's highly likely that the other end can't successfully send a packet larger than they can receive, but it's not unlikely that something in the middle mangles SYN to reflect the true MSS, but doesn't mangle SYN+ACK. I could rant all day. You can also get very good results by reflecting the received RSS minus 8 (assumed PPPoE), 20 (assumed IPIP tunnel), or 28 (assumed PPPoE over IPIP tunnel).
deleted 4y ago
[deleted]
bsagdiyev 4y ago
Xfinity had a router that did not work with the Xbox One when it came out. Wired was fine but wireless just did not work. I believe a software update fixed it and I don't recall if it was the router or the Xbox that was ultimately the issue. Fielded a lot of grumpy calls that Christmas morning.
daze42 4y ago
Any chance it could be MTU related? Sounds like the issue is only popping up when attempting to use full packets.
- mbreese 4y ago
  I was thinking DNS and/or IPv6. For me, it's always DNS until proven otherwise. But the difference of some sites loading, but others not makes me suspect there's a split somewhere and IPv4 vs 6 seems as likely as anything.
  - BLKNSLVR 4y ago
    I second the "always DNS until proven otherwise" sentiment, but in my case it's often self-inflicted in my obsessive desire to force all devices on my network to route their DNS requests through my PiHole. It has caused some significant weirdness, and I've had to relax the rules just to get certain things to work at all.

mrb 4y ago

I'm fairly confident you are victim of a PMTUD black hole. It's easily fixed by making your router force the TCP MSS to a slightly lower value. All your symptoms are explained by this (some but not all devices are affected, some but not all services are unreachable).

kalleboo 4y ago
Yeah, not having an option to set the MTU was the reason I had to stop using the Apple AirPort Extreme when we moved to a new apartment, the symptoms were all the same as GP, limiting the MTU fixed it.
cryptonector 4y ago
Or better yet, use packetization PMTUD. 15 years after that was published by the IETF, every device should implement it by default.
- toast0 4y ago
  Apple is actually pretty good about PMTUD as a sender, at least iPhones (but I assume Macs too) will quickly fallback to sending shorter packets if they don't get an ack with a large packet at the beginning of a TCP connection. I'd guess they do it throughout the connection, but I only saw it because network was broken, pcaps from iPhone show working connection, pcaps from Android show broken connection. It doesn't help that FreeBSD used to do MSS sensibly (thanks to a patch from Microsoft), and switched to doing it the way everyone else does. There's not a good reason to send your naive MSS on SYN+ACK if it's bigger than the received MSS, it's highly likely that the other end can't successfully send a packet larger than they can receive, but it's not unlikely that something in the middle mangles SYN to reflect the true MSS, but doesn't mangle SYN+ACK. I could rant all day. You can also get very good results by reflecting the received RSS minus 8 (assumed PPPoE), 20 (assumed IPIP tunnel), or 28 (assumed PPPoE over IPIP tunnel).

deleted 4y ago

[deleted]

bsagdiyev 4y ago

Xfinity had a router that did not work with the Xbox One when it came out. Wired was fine but wireless just did not work. I believe a software update fixed it and I don't recall if it was the router or the Xbox that was ultimately the issue. Fielded a lot of grumpy calls that Christmas morning.

daze42 4y ago

Any chance it could be MTU related? Sounds like the issue is only popping up when attempting to use full packets.

mbreese 4y ago
I was thinking DNS and/or IPv6. For me, it's always DNS until proven otherwise. But the difference of some sites loading, but others not makes me suspect there's a split somewhere and IPv4 vs 6 seems as likely as anything.
- BLKNSLVR 4y ago
  I second the "always DNS until proven otherwise" sentiment, but in my case it's often self-inflicted in my obsessive desire to force all devices on my network to route their DNS requests through my PiHole. It has caused some significant weirdness, and I've had to relax the rules just to get certain things to work at all.