Firefox Hangs In Ver. 17.2

[itman 1,741]

Win 10 22H2, Firefox ver. 128, ESSP ver. 17.2.7.

This has been going on for a while. The behavior is completely random. I can go a 1/2 day, 1 day with no Firefox hanging. Then it starts again.

The behavior is Firefox locks up and a short time later, my network connection is disabled; both IPv4 and IPv6. If I shutdown Firefox and wait up to a minute, the network connection restores itself. The action that triggers the hanging the most is use of back web page function in Firefox but it has occured when attempting to access another web site. The worst offending web site is the Eset forum when I am logged into it!

Since the loss of network connection behavior first exhibited when Eset had http/3 scanning issues, I proceeded to diagnose/test assuming that was the source.

The first thing I did was enable Eset pre-release updating to receive firewall modue ver. 1449 since I saw a recent forum posting that was a fix for recent http/3 issues. It didn't help.

Next, I proceeded to test with enabling/disabling http/3 scanning in Eset and both Firefox in various combinations. That didn't help.

What does fully stop the hang behavior is I disabled Secure all browsers option. Haven't had a Firefox hang w/network connection loss since then. I have seen Firefox occasionally pause at times, but it recovers w/o issue and most important, does not disable my network connection.

Edited July 18 by itman

[itman 1,741]

@Marcos, I found what was causing the Firefox hanging w/loss of network connection when Secure all browsers option is enabled.

Since by far the web site where this hanging occurred most was the Eset forum; i.e. https://forum.eset.com/, I disabled Firefox Enhanced Tracking Protection which I run in "Strict" mode for the above URL. I haven't had a FireFox hang since.

As evidence the Eset forum web site behavior is questionable, I tried to create a permanent Enhanced Tracking Protection exception for the above URL and it didn't work; Firefox ignored the exception. I have to manually disable Enhanced Tracking Protection each time the Eset forum web site is accessed.

Prior to ver. 17.2 and/or latest releases of Firefox, I never had an issue with Eset forum web site and Firefox Enhanced Tracking Protection Strict mode.

[itman 1,741]

I found out what was the issue with Firefox and Secured Browser mode. It's Firefox's Private Browsing mode. Once I adjusted Firefox's History settings to other than Private Browsing mode, I haven't had a Firefox hang since.

It nonetheless still sucks I can't use Private Browsing mode with Secured Browser mode enabled.

[Peter Randziak 1,160]

Hello @itman,

thank you for the detailed issue description and the investigation you made. We checked it with the development team, they provided us with directions how to proceed.
 

Can you reproduce the issue, or does it occur randomly? Does it happen upon launching the browser, or later during its use? If you can reproduce it, we'd like to see Firefox performance logs, HIPS logs, Safe Banking and Browsing logs and Procmon log.

 

Close the browser (make sure no process is running).
Enable:
Advanced setup > HIPS > Advanced setup > Log all blocked operations
Advanced setup > Tools > Diagnostics > Advanced logging >  Enable Browser protection advanced logging

 

Then:
Run Firefox, press F12 > Performance tab > Start recording > load the web that lags > Capture recording.
You should have something like this:

 

Press Upload Local Profile (you can upload it to Mozilla server and send a link, or download it and send it, that's up to you)

 

Then disable advanced logging and create ESET Log Collector output, while the browser is running.
Ideally, you can capture this whole thing via Procmon too (start capturing before launching the browser).

 

Once you have them, pack all the logs into a single archive, upload it to a safe location and send me and @TomasP the download details with a reference to this forum topic.
 

Thank you, Peter

[itman 1,741]

7 hours ago, Peter Randziak said:

Can you reproduce the issue, or does it occur randomly? Does it happen upon launching the browser, or later during its use?

It's random and the occurrence frequency is frustrating as hell. I can go for a day using Firefox w/o any hang up issues. The next day when I open Firefox and access the Eset forum web site, Firefox will hang w/loss of Internet connectivity. Ditto for navigation within the Eset forum web site; notably when signed on and using back web page navigation. I shut down Firefox and in a minute of so, Internet connectivity is auto reestablished on my device. This same activity has occurred on other web sites but I would say 90% of the time, it's the Eset forum web site that it occurs on. Finally and lately once the above hang activity occurs, I usually will not get any further hangs for that day. Also, clearing FireFox cache after a hang w/o loss of Internet connectivity will resolve any further hang activity.

Yesterday, I saw Eset pushed a hot fix for HTTP/3 issues Eset latest version Endpoint users were having. After that was received on my device, I switched back to Firefox Private Mode; i.e. Never remember any history, Today, so far no Firefox hang issue. I have my fingers crossed that this HTTP/3 fix is the permanent fix to my Firefox issues. I will note that month's back when Eset was not filtering HTTP/3 traffic, similar Firefox hang behavior w/loss of Internet connectivity occurred. It was worse then in that I had to reboot the PC to reestablish Internet connectivity. Finally, Mozilla pushed ver. 129 update for Firefox and that also might help in this issue.

Another possible factor. My ISP, AT&T, uses 6rd tunneling for IPv6 network connections. Over the years, getting this to work w/o Eset networking conflicts has been a nightmare. I have been able to finally resolve these issues within the last six months or so. Coincidentally, this is when the Firefox hang issues started. As I see it, a Firefox hang should not take down one's Internet connection. So this might be related to Eset handling of IPv6 tunnel broker processing.

Edited August 7 by itman

[Peter Randziak 1,160]

Hello @itman,

thank you for the details provided.

Hopefully, it will be fixed by the fixes in the HTTP/3 scanning or the other changes you mentioned.

Peter

[Marcos 5,234]

Have you switched to the pre-release update channel recently? Asking since the Internet protection module 1482 that adds HTTP/3 scanning and fixes previous issues was put on the pre-release update channel on July 29.

[itman 1,741]

6 hours ago, Marcos said:

Have you switched to the pre-release update channel recently? Asking since the Internet protection module 1482 that adds HTTP/3 scanning and fixes previous issues was put on the pre-release update channel on July 29.

Not yet.

Something has definitely change in FF ver. 129. FF in Private Browsing mode is not fully clearing its cache at FF close. So far, this seems to have resolved things. I got a few short hangs yesterday, but FF recovered nicely w/no loss of Internet connectivity.

[itman 1,741]

Well, Firefox hung today w/loss of Internet connectivity. I have switched to ESSP pre-release updating as noted above. I have my doubts this is related to HTTP/3. Time will tell.

[Peter Randziak 1,160]

Hello @itman,

thank you for keeping an eye on it and keeping us posted.
Yes it is possible that it might now be related to the HTTP/3 scanning, as you noted.

[itman 1,741]

13 hours ago, Peter Randziak said:

Yes it is possible that it might now be related to the HTTP/3 scanning, as you noted.

Well, that didn't take long. Firefox started hanging almost immediately on Eset forum web site w/pre-release updates. The hanging was worse; much worse in fact. So am I now back on the regular update channel.

I am also getting more and more convinced this hanging has to do w/Eset forum captcha, re-captcha processing.

Edited August 9 by itman

[itman 1,741]

Here'e the latest on this issue.

Last weekend, I reset Fixfox and proceeded testing with various Firefox and Eset settings. Multiple times when I thought I found a solution, Firefox would randomly hang w/loss of Internet connectivity. Also, always on the Eset forum web site!

Last Tuesday, updated Win 10 with August cumulative update. So far, no more Firefox hanging w/loss of Internet connectivity. What changed? Strongly suspect it was due to this IPv6 vulnerability: https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/ that was patched. Now the remaining question is what on the Eset forum web site was attempting to exploit this vulnerability?

[itman 1,741]

Shortly after the above posting, Firefox started hanging again in Eset Secured browser mode. So this time, I uninstalled/reinstalled Firefox and have been testing/monitoring since.

I have now found out what the issue is and not surprising to me, it is the 6rd tunneling my ISP, AT&T, performs on its issued routers and network.

What I observed is when I use my ISP DNS servers in Firefox, the Firefox lockups w/loss of Internet connectivity occur almost immediately and are frequent.

If I set Firefox to default DNS-over-HTTPS mode, the lockups are random and unpredictable. Why? If you refer to Firefox settings documentation, defaut DoH mode will defer to ISP DNS servers only when there is a connection problem with Firefox default DoH ISP provider, Cloudflare.

What is working so far w/o lockup issue is if set Firefox DoH setting to Aggressive.

I have given up on Eset ever figuring out how to process ISP based 6rd tunneling properly.

Edited Thursday at 02:05 PM by itman

[sesk 23]

if i may ask, does this occur if you use brave/chrome ?   yes, i understand, you are a firefox user.

[itman 1,741]

2 hours ago, sesk said:

if i may ask, does this occur if you use brave/chrome ?   yes, i understand, you are a firefox user.

I haven't tried either and I am not going to install either to test with.

Of interest is Cloudfare recommends either Increased or Maximum DoH protection in Firefox:

Quote

Mozilla Firefox

1. Select the menu button > Settings.
2. In the Privacy & Security menu, scroll down to the Enable secure DNS using: section.
3. Select Increased Protection or Max Protection. By default, it will use the Cloudflare provider.
4. If this is not the case, select Cloudflare in the Choose Provider dropdown.

Edited Thursday at 07:45 PM by itman