• 0 Posts
  • 24 Comments
Joined 1 year ago
cake
Cake day: August 8th, 2023

help-circle







  • It probably has to do with being native ipv6 and needing to ride a 6to4 nat to reach the broader internet.

    Start at 1400 and walk the MTU down by ~50 until you find stability, then id creep it back up by 10 to find the ‘perfect’ size, but that part isn’t really needed if you’re impatient. :)

    E. I found 1290 was needed for reliable VPN over an ATT nighthawk hotspot.


  • Latency plays a big role in throughput. If one download target was ‘closer’, i.e. lower latency, it will be able to scale the windowsize higher, therefore allowing more data to flow through for a given connection. Imagine network packets are envelopes and data is paper. Not all envelopes can carry the same amount of paper for a given connection, and the more paper you stuff in your envelope, the faster the transfer completes.









  • You are absolutely correct, I should have lead with that. Encrypted client handshake means no one can see what certificate you are trying to request from the remote end of your connection, even your ISP.

    However, It’s worth noting though that if I am your ISP and I see you connecting to say public IP 8.8.8.8 over https (443) I don’t need to see the SNI flag to know you’re accessing something at Google.

    First, I have a list of IP addresses of known blocked sites, I will just drop any traffic destined to that address, no other magic needed.

    Second, if you target an IP that isn’t blocked outright, and I can’t see your SNI flag, I can still try to reverse lookup the IP myself and perform a block on your connection if the returned record matches a restricted pattern, say google.com.

    VPN gets around all of these problems, provided you egress somewhere less restrictive.

    Hope that helps clarify.