Hacker News Reader

Comment by greenspot | Hacker News Reader

Makes sense but wouldn't they then use the netflix domain? Something like netflix.com/fast? I could image that if providers throttle it would be a mix of IPs and domain.

View on HN

If you look at the actual traffic, it's hitting netflix's content servers. e.g. ipv6_1-lagg0-c001.2.bne001.waia.isp.nflxvideo.net

The interesting traffic is not to fast.com.

If you look they aren't using fast.com as the domain they are downloading files from. That's just the domain that hosts the page. It doesn't matter if it gets throttled because it only serves up a few kb of html.

Some ISP's (we don't throttle anything) throttle based on several factors, mainly packet signatures. Traffic coming from big/known sources, such as Netflix, contain unique signatures (probably the headers, etc, that are unique to Netflix Traffic). You can then check all incoming packets that match those signatures and throttle them. So unless Netflix went out of their way to mask every request to look like video content, there's not a whole lot you could do.

The files that fast.com has you download ARE chunks of video files :)

Does anyone know which video the test file is?

Perhaps it's encrypted, or a Netflix promo piece.

Wouldn't there be copyright issues to use their actual streaming licences content?

Earlier I got curious and I was wondering this too. Seems to be a 'random' blob of bytes every time that doesn't decode, but then I remembered they serve DRM'ed video that is then decrypted on the client.

If you have a Netflix subscription it's probably this or something like this [1]. For non-flixers it's a calibration video similar to [2]

[1] https://www.netflix.com/watch/80103278

[2] https://www.youtube.com/watch?v=cGgf_dbDMsw

The connection is encrypted, the ISP can't see request headers. For the main data download, all they can determine is its an TLS connection to a netflix content server. Potentially you could do some stateful monitoring looking for recent requests to fast.com but it's generally much harder to implement than simple IP or SNI based profiling.

All of the traffic is HTTPS. The ISP doesn't get to see headers.

Reply on news.ycombinator.com