#arpnetworks 2014-08-26,Tue

RandalSchwartz

no... just a visitor

mus1cb0x

ah
why are you there?

RandalSchwartz

but I'm openvpn to arp, and still getting weirdness
www.insightcruises.com/events/sa22/
even tried a few other vpn

BryceBot

That's what she said!!

[14:34]

brycec

BryceBot: no

[14:34]

BryceBot

Oh, okay... I'm sorry. 'even tried a few other vpn'

[14:34]

m0unds

hahaha
s/vpn/potatoes

[14:35]

BryceBot

<RandalSchwartz> even tried a few other potatoes

[14:35]

brycec

(Wow, that "no" trained it from 97% to 11%)

[14:35]

RandalSchwartz

this is the first time that mtr showed the fifth or sixth hop going through a 10.x address
I fear I'm TCP over TCP at the border of ketchikan

[14:36]

m0unds

oh, alaska, cool
how's the weather up there?

[14:38]

RandalSchwartz

cool. :)

[14:38]

m0unds

awesome
just saw 62F as the temp today - that sounds great
haha
m0unds is sick of 90+F temps

[14:38]

RandalSchwartz

yeah - switched from summer coat to winter coat for today's shoreside

[14:39]

m0unds

neat

[14:39]

RandalSchwartz

I can't get to google.com from here. but I can ssh to arp. but I can't openvpn to my arp box, just a few others.
I wonder if they have screwed up BGP
but that should then still work if I openvpn to somewhere.
I don't understand this failure
I wonder if it's reverse DNS
no... host 206.223.199.52 gives a fast rever
revers

[14:40]

brycec

If you can't hit certain ports, then sounds like filtering. What's the ISP?

[14:43]

RandalSchwartz

I don't know that it's about certain ports
many web sites come up instantly. Many others don't.
that'd all be 80 or 443

[14:44]

brycec

I was focussing on the OpenVPN, but I see where you said some work others don't
*focusing

[14:45]

RandalSchwartz

my openvpn is on udp 443
but even once I'm on a vpn that *does* work, I still get weirdness

[14:45]

brycec

So seems like the ISP (and not the Internet or ARP) is screwy

[14:46]

RandalSchwartz

I don't see how you come to that conclusion
if I can get *some* VPN, the local ISP can't tell what I'm doing
and yet the behavior seems similar

[14:47]

brycec

Just because you got to those VPN doesn't mean your traffic isn't still traveling over that ISP

RandalSchwartz

but the packets are opaque

brycec

I'm suggesting that the ISP has broad problems, dropping packets probably

RandalSchwartz

no... also tested that with mtr
under 2% loss

brycec

But >0? That sucks

[14:50]

RandalSchwartz

and this "curl -o /dev/null https://arpnetworks.com/100mb.bin" runs at 500kbps
KBps
well mostly 0
but I saw a few when I went to larger packets
the 10.x address in the mtr still scares me

[14:50]

brycec

Nothing out of the ordinary in my smokepings https://smokeping.cobryce.com/?target=ARP.ARPWebsite

[14:51]

m0unds

is it rural enough to be wireless or something?

[14:53]

RandalSchwartz

ahh... I had my openvpn listening on tcp not udp
now I connect fine to arp

[14:53]

m0unds

oh, that'd do it

[14:53]

brycec

m0unds: Well there are no roads to Anchorage, does that count as rural? :P

RandalSchwartz

but STILL can't connect to $randomwebsite equally well

m0unds

haha, it's not rural if you're comparing anchorage to other places in AK

RandalSchwartz

ketchikan is a lot smaller

m0unds

yeah, i saw it on the map

brycec

I've been to both :)

BryceBot

That's what she said!!

brycec

BryceBot: no

BryceBot

Oh, okay... I'm sorry. 'I've been to both :)'

brycec

lol

m0unds

hah

RandalSchwartz

is that a new trigger?
I think it needs to default to "no", and you can say "yes" :)

BryceBot

That's what she said!!

RandalSchwartz

heh!

brycec

RandalSchwartz: It's actually learned, not a "trigger"

m0unds

s/yes/potatoes

BryceBot

<RandalSchwartz> I think it needs to default to "no", and you can say "potatoes" :)

brycec

There's a bayesian net behind it
Like spamassasin, but for "that's what she said"
BryceBot: no

BryceBot

Oh, okay... I'm sorry. 'I think it needs to default to "no", and you can say "yes" :)'

brycec

I love hot dogs

RandalSchwartz

Yeah - I'm still just puzzled by this net issue

brycec

BryceBot: yes

BryceBot

Okay! twss! 'Yeah - I'm still just puzzled by this net issue'

brycec

BryceBot: no

BryceBot

Oh, okay... I'm sorry. 'Yeah - I'm still just puzzled by this net issue'

RandalSchwartz

heh

brycec

As you can see, there are both yes and no

RandalSchwartz

"that's what she said"
this damn net issue
my mtr to www.google.com hits my vpn, then arp, then essentially google
and yet www.google.com doesn't load
but feedly.com does essentially the same, but LOADS IMMEDIATELY.
I do NOT understand this behavior

m0unds

are you routing everything over the vpn?

RandalSchwartz

yes
even dns

m0unds

huh, funky

RandalSchwartz

you're telling me!

BryceBot

That's what she said!!

brycec

Can you curl/lynx/wget/whatever www.google.com on your vps?

RandalSchwartz

I think your bayes was a little loose
you mean on my laptop?

brycec

RandalSchwartz: no I mean on the openvpn server
(I know, obvious things to check)

RandalSchwartz

Well, what's weird, is it works on my laptop

[15:02]

brycec

FWIW my bayes requires a 97% match

[15:02]

RandalSchwartz

it's just safari and chrome and firefox that can't get it
chome says "establishing secure connection" then stops.

[15:02]

brycec

I wonder if your browsers are trying ipv6? And can you curl google from your laptop?
(because debugging connectivity in a browser is convoluted compared to "curl -v")

[15:03]

RandalSchwartz

hmm. maybe v6 interesting.
yes, google from laptop curl
both http and https

[15:04]

brycec

And curl used v4?

RandalSchwartz

Presume so
but I have no default v6 route

brycec

Would've been in the -v output. If curl can reach it but not browsers...
RandalSchwartz: did you curl https:// ?

RandalSchwartz

lemme try

brycec

Might be an MTU thing

RandalSchwartz

... * Rebuilt URL to: https://www.google.com/
* Hostname was NOT found in DNS cache
* Trying 74.125.25.99...
ahh... so if I set my MTU lower somehow?

[15:06]

brycec

Assuming the issue is on your computer
More likely some naughty gear along the path

[15:07]

RandalSchwartz

that wouldn't explain why some sites and not others
same opaque content either way

[15:08]

brycec

http works when https doesn't often means that the SSL cert being returned is hitting an MTU ceiling somewhere along the path

[15:09]

RandalSchwartz

reduced mtu from 1500 to 1400 for both wifi and tunnel
no - http doesn't work
google.com for either, no work.
at least not in browser. works in curl.
what else is browser doing? :(

[15:09]

brycec

RandalSchwartz: browser is automatically switching to https because Google is on the HSTS list
(one more reason to use curl :P)
You could try http://74.125.25.99 in the browser to test, perhaps (if it doesn't provide the hsts header)

[15:10]

RandalSchwartz

browser still paused
worked fine at command-line though

[15:11]

brycec

Did the browser pause saying "establishing secure connection"?
Perhaps your browsers are trying a proxy? (grasping at straws)
Perhaps you should just reboot? :P

[15:12]

RandalSchwartz

Oooh... google main page came up, and still trying to "establish secure connection"

hmm. https://www.superfish.com/

what the F is that

[15:13]

brycec

malware
http://malwaretips.com/blogs/superfish-window-shopper-adware/

[15:14]

RandalSchwartz

dammit.
can't get taht page either
what's the uninstall instructions
I can't even hit sfari's extensions page

[15:15]

brycec

RandalSchwartz: can you access vps3.cobryce.com? I'll host a copy
(that vps is on ARP)

[15:16]

RandalSchwartz

no it's probably still gonna try to hit superfish

[15:16]

brycec

RandalSchwartz: curl http://sprunge.us/TXIK
just a copy/paste of the text on the page
(Apparently there about 5 different places to uninstall/remove it)
Relevant https://support.mozilla.org/en-US/questions/878411 :)
"How do remove www.superfish.com permanently - it interferes whenever I open my Firefox browser ... no matter which website I wish to visit ?"
Looks like a bunch of plugins/extensions use it for ad revenue
RandalSchwartz: try starting Firefox in safe mode (without loading any extensions)
https://support.mozilla.org/en-US/questions/830223 "How did Superfish get on my PC?"

[15:17]

RandalSchwartz

I can't see any of those

[15:20]

BryceBot

That's what she said!!

[15:20]

brycec

BryceBot: no

BryceBot

Oh, okay... I'm sorry. 'I can't see any of those'

brycec

Even after? │15:18:55 brycec | RandalSchwartz: try starting Firefox in safe mode (without loading any extensions)

***

sga0_ has joined #arpnetworks

RandalSchwartz

how do you do that?

brycec

Pretty sure there's a shortcut for it in the start menu

***

pjs has quit IRC (Read error: Connection reset by peer)

brycec

(sounds like you're using Windows - please correct me if I'm wrong)

RandalSchwartz

"start menu"
no - OSX
wait - neil says he's better after reboot
gonna
try that