[187297] in North American Network Operators' Group
Re: Netflix NOC? VPN Mismarked?
daemon@ATHENA.MIT.EDU (Hugo Slabbert)
Tue Jan 26 15:09:56 2016
X-Original-To: nanog@nanog.org
Date: Tue, 26 Jan 2016 12:03:46 -0800
From: Hugo Slabbert <hugo@slabnet.com>
To: Ryan Gard <ryangard@gmail.com>
In-Reply-To: <CAAQxoQG1DLbfNaA7wOto+MtJ_=PEogWXNq0msZPeggRU0C-WBg@mail.gmail.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
--vEao7xgI/oilGqZ+
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sun 2016-Jan-24 22:32:42 -0500, Ryan Gard <ryangard@gmail.com> wrote:
>Hey,
>
>Per chance if someone @ Netflix could reach me off list? Seems that as of
>this weekend there's a number of our clients (residential internet) who are
>unable to utilize Netflix directly, instead being presented with a message
>advising them they're using a VPN service... Have a feeling that our IP
>blocks were lumped in with someone somehow...
>
>Thanks!
We had a similar issue, though in that case we found:
1. The user had been sharing the account between 3 different households=20
across (a) 2 different IP blocks within our network and (b) with a 3rd user=
=20
on an entirely different ISP in the US (we're in Canada), with multiple=20
devices in use by some locations.
2. The sites across which the same account was being shared had different=
=20
connectivity options, with one of those having a decent chunk of MTU=20
overhead on the connection (l2tp + pppoe etc.), perhaps raising some flags=
=20
in Netflix's detection due to smaller MSS?
3. Using the same account on different IPs on the same provider also got=
=20
blocked.
4. Using a different account on the *exact same IPs* did not have any=20
streaming issues, suggesting Netflix was flagging the account rather than=
=20
(just) the IPs.
Dunno if that helps, but it may be beneficial if Netflix can provide some=
=20
guidance on the logic in the "this is behind a VPN/proxy" detection (though=
=20
I am assuming they likely won't disclose that so as not to give away=20
secrets to the other party in the arms race).
>
>--=20
>Ryan Gard
--=20
Hugo
hugo@slabnet.com: email, xmpp/jabber
PGP fingerprint (B178313E):
CF18 15FA 9FE4 0CD1 2319 1D77 9AB1 0FFD B178 313E
(also on Signal)
--vEao7xgI/oilGqZ+
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJWp9EiAAoJEJqxD/2xeDE+kt8QAIYEyR3GrScZ72BKN2nIWaUU
wCF24BtTsLHMNIcS3cLCR4sNa7fhVrtLBJ/jOr/ZDaureI35fs2Ck84sN1tiJlh0
lczNGvU59mLzR7T5U5Scyeeov/UyRmDhRFcFVUkUQ9QLhi/DSzH0GX7NVchZ0mJu
f+hZw7tmQMGz6WEPQsS5v5rwCnYowjTYbBLjPEtx6ZIbJUgKm25qnzBu133nx4BL
Qf9PC4T8ZtmE9Moardozr9HTNBprVJNfy3YWi7OGrIuCIcptXk/KNR68TrRKWROH
pHxC7s/y0mz4GW0voLXEM/jJqUm63AScbfHVZyNY8alCeg6o5jC9Ti3ibCxFFm/C
5k2g5EGtxEFh3ejC40ix5SxDK/itshNlkIozlJrDxueCG2qh10+iJx7sMxvKK7h8
D5B5xSISSVHLtW3dhlL2wOTVJ1IiApLLN+p4XPnxu5KUnejQABvZ1WIcm1IAutYD
o+ICv9XapTwiEz9w/nbpkd6/4sSdiuDyUZXtR5nZ+b5DqS68SA7DWeiGDYBRuJT7
qtKx7/UZe9v5W5U1YZ7eB9Q5LrDY6pcAdqb2SI5IILSP/od8tTKEb3ta0gXky/ZX
Fo2/YyazYk0EwseqNf2/qX1OEwPCHqGMAa8HNIzShpoOTduqHty8OvuxLRQaYFBL
X0k7KewZyjzePKxjymHB
=FHnt
-----END PGP SIGNATURE-----
--vEao7xgI/oilGqZ+--