[anti-censorship-team] Trying to understand multi-bridge dynamics post after Fastly/Cloudflare domain front change

[David Fifield]

On Sun, Sep 24, 2023 at 09:38:33PM -0600, David Fifield wrote:
> On Thu, Sep 21, 2023 at 09:26:58PM -0600, David Fifield wrote:
> > I made a graph of the bandwidth on the two bridges since this started
> > happening.
> > 
> > The two vertical lines mark:
> > 2023-09-20 14:00:00	earliest known case of domain resolving to Cloudflare
> > 2023-09-21 18:00:00	change to foursquare.com in rdsys
> > 			https://gitlab.torproject.org/tpo/anti-censorship/rdsys-admin/-/merge_requests/17
> > 
> > 1. snowflake-02 bandwidth has dwindled to almost nothing. Seriously
> >    almost nothing: it's around 3 MB/s currently.
> > 2. There's a huge almost instantaneous step in snowflake-01 at around
> >    2023-09-21 13:00:00. At first, I thought this might have been a
> >    consequence of the rdsys change, but it's about 5 hours earlier than
> >    that. What could it be? Some unrelated unblocking event that just
> >    happened to happen while this domain stuff is happening?
> 
> The non-use of snowflake-02 continues -- see the attached graph. I'm
> racking my brain trying to understand that is. snowflake-01 usage has
> decreased a lot too -- the graph appears to be at about the same level,
> but you can see it's not brickwalled at the upper end of the range as it
> was before. Even ignoring the step anomaly at 2023-09-21 13:00:00, it
> didn't go to zero like snowflake-02 did.

The snowflake-02 bridge is recovering, but very very slowly. It's now up
to about 12 MB/s.

I've attached graphs showing simultaneous clients, bandwidth, and
clients by country for both bridges over September 2023.

* The loss of users was not proportional to the loss of bandwidth at
  snowflake-01. Users went from 50k to 30k, while bandwidth went from
  31 TB/day to 28 TB/day. On snowflake-02, both went to zero.
* On snowflake-01, not all countries were equally affected. Russia and
  China had bigger relative decreases than Iran did.
* There was a 50% increase in bandwidth at snowflake-01 on 2023-09-08,
  the cause of which I do not know.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: snowflake-userstats-bridge-transport-202309.png
Type: image/png
Size: 78335 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/anti-censorship-team/attachments/20231003/3c3e96b4/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: snowflake-bandwidth-202309.png
Type: image/png
Size: 72761 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/anti-censorship-team/attachments/20231003/3c3e96b4/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: snowflake-top-countries-202309.png
Type: image/png
Size: 201241 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/anti-censorship-team/attachments/20231003/3c3e96b4/attachment-0005.png>