While troubleshooting possible network traffic problems between external taskcluster ELB/ALB (such as queue.taskcluster.net) and the Mozilla data centers (MDC1, MDC2, SLC3), I noticed the ELB/ALB security groups do not allow ICMP. This hampers proper network route and performance testing in situations like this. I propose changing the security groups for all external (public) taskcluster applications (ELB/ALB/public EC2 instance) to allow ICMP traffic.

I don't think we use any ELBs or ALBs (TIL "ALB"). Are there specific hosts that are ignoring ICMP?

(In reply to Dustin J. Mitchell [:dustin] pronoun: he from comment #1) > I don't think we use any ELBs or ALBs (TIL "ALB"). Are there specific hosts > that are ignoring ICMP? Ahh this is probably a heroku app not that I think of it. This host in particular is taskcluster-artifacts.net. This wouldn't happen to be a CDN would it?

It is, indeed, a CDN - CloudFront.

(In reply to Dustin J. Mitchell [:dustin] pronoun: he from comment #3) > It is, indeed, a CDN - CloudFront. Thanks for the confirmation and it does looks like ICMP is allowed against AWS CDN endpoint IPs.