My ISP blackholed Fastly and I spent a day blaming my code

GitHub loaded, but naked. No styles, no JS, just blue links on white like it was 1998. Reddit didn't load at all, it just spun until the tab gave up. Everything else on the internet was fine.

So I did what any developer does. I blamed everything I own.

1. 01Browser cache. Cleared it. Still broken.
2. 02Extensions. Disabled all of them, opened an incognito window. Still broken.
3. 03DNS. Flushed it, switched from my ISP resolver to 1.1.1.1, then to 8.8.8.8. Still broken.
4. 04My own hosts file, on the theory that past me had done something stupid. Past me was innocent for once.
5. 05Windows Defender, then the whole firewall. Off, tested, back on. Still broken.

I burned a genuinely embarrassing amount of time here. The reason is that all of those are things I control, and when something breaks, the first instinct is to look where you have power.

I turned on my phone's hotspot, connected the same laptop to it, and loaded GitHub.

It worked perfectly.

Same machine. Same browser. Same DNS settings. Different transport. That single result kills every theory about your box in one shot, and it took less time than clearing a cache. I now run it before anything else.

My home connection is Converge ICT, wired ethernet, behind CGNAT. Converge runs as AS17639.

The things that were broken had one thing in common. Reddit sits behind Fastly. So do GitHub's static assets. Fastly is AS54113, and its biggest chunk of address space is 151.101.0.0/16.

DNS was resolving fine, which is exactly what made this confusing. I was getting real answers back with real Fastly IPs in them. The failure was one layer down. The TCP handshake went out and nothing ever came back. No refusal, no reset, no ICMP unreachable, just silence until the timeout.

That distinction is the whole thing. A DNS failure tells you something. A silent timeout tells you the packets are going somewhere that doesn't answer, and from a consumer connection you cannot see where. A traceroute would die at a hop inside the ISP and give me nothing useful after that.

Converge's route to that Fastly space was dropping traffic on the floor. Not all of Fastly, just that prefix, from that network, on that path. My phone was on a different carrier with a different route, so it was unaffected.

Fastly is anycast, and their address space is much bigger than one /16. They publish the full list at https://api.fastly.com/public-ip-list, and it includes 199.232.0.0/16, 146.75.0.0/17, 185.31.16.0/22, and a stack of others.

If one prefix is unreachable and another one isn't, you can just point your machine at the one that works. Fastly serves the right site based on the TLS SNI in your request, not based on which edge IP you happened to land on, so a hand picked edge still returns the correct content.

My hosts file now has a block like this:

Reddit came back immediately.

Here is the part I found genuinely interesting.

github.githubassets.com resolves into 185.199.108.0/22. That range is GitHub's own, listed in their published metadata at https://api.github.com/meta, and it is the same range that serves GitHub Pages and raw usercontent. But it is served across Fastly's edge network, which is why it died alongside everything else Fastly on my connection.

The problem is size. That block is 1024 addresses total, and the assets hostname answers on a handful of anycast IPs inside it. There is no second prefix to fall back to. With Fastly's own space I had a dozen ranges to pick from. With GitHub's, the entire pool sits behind the same broken path.

So there was no alternate to pin, and GitHub's UI stayed unstyled until the route recovered on its own. I coded over cellular in the meantime.

Behind CGNAT you have no control and no visibility. You cannot see the AS path. You cannot ask for a different route. And filing a support ticket that says "your peering to AS54113 is dropping packets to 151.101.0.0/16" gets you a scripted reply about restarting your modem, because the person reading it has no path to the network team either.

That is not a Converge problem specifically, it is what residential internet is. You are buying an average, not a route.

What I changed afterward is small and it has already paid for itself. I keep the hotspot configured and one tap away, and I switch transports before I touch anything else. Not because it fixes the problem. Because it tells me in half a minute whether the problem is even mine.

Most of the day I lost wasn't debugging. It was assuming.