EA Auth Server on AWS Global Accelerator rejects valid auth requests (IP 15.197.149.64 accounts.grpc.ea.com)

Battlefield 6 Connection Failure from UK / Globally — accounts.grpc.ea.com DNS Resolution Bug

Summary

Battlefield 6 fails to connect ("Connection Failed") when DNS resolves accounts.grpc.ea.com to 15.197.149.64 (AWS Global Accelerator) as the primary IP. When the same hostname resolves to 99.83.166.42 (CloudFront) as the primary IP, authentication succeeds. The game always uses the first IP returned by DNS and does not fall back to the second on failure.

Environment

• Game: Battlefield 6 (Steam, PC)
• OS: Windows 11 Pro (Build 26200)
• Network: All connections on the same LAN (192.168.1.0/24), same router, same DNS servers, same ISP
• Adapter: Realtek USB GbE (same physical adapter used in all tests)

Reproduction

The issue is reliably reproducible based on which IP address DNS returns first for accounts.grpc.ea.com:

Adding a hosts file entry to force accounts.grpc.ea.com to 99.83.166.42 resolves the issue on the failing network path.

Technical Analysis

Full packet captures (pcapng) were taken on all three network paths using dumpcap/tshark. The captures show:

1. The gRPC authentication exchange differs by server endpoint

When connecting to 99.83.166.42 (CloudFront) — SUCCESS:

• Client sends 1273-1274 byte auth request
• Server responds with 527 bytes, then 380-381 byte auth response
• Client sends 366 byte follow-up
• Server returns 7081-7083 bytes of session/token data
• Game proceeds to Blaze redirector and game servers

When connecting to 15.197.149.64 (AWS Global Accelerator) — FAILURE:

• Client sends 1225 byte auth request (48 bytes shorter)
• Server responds with 527 bytes, then 424 byte auth response (different from success)
• Client goes silent for 11 seconds
• Client retries with 1042 bytes
• Server responds with 113 bytes (rejection)
• Client sends RST, game displays "Connection Failed"

2. All other EA services work correctly on all paths

• eaanticheat.ac.ea.com — anticheat verification completes successfully
• cdn.eaanticheat.ac.ea.com — CDN downloads complete successfully
• gcs.ea.com — game config service connects successfully
• collector.errors.ea.com — error reporting works (contacted in both success and failure cases)
• All TCP connections establish correctly (SYN/SYN-ACK)
• All TLS handshakes complete successfully
• Zero packet loss on all network paths

3. The failure is isolated to the gRPC auth endpoint

The only difference between working and failing sessions is which IP serves accounts.grpc.ea.com. The two IPs appear to behave differently:

• 99.83.166.42 (CloudFront): Returns valid authentication/session data
• 15.197.149.64 (AWS Global Accelerator): Returns a rejection response

4. No client-side network issues

Network diagnostics confirmed identical configuration across all paths:

• Same IP address (192.168.1.241 on ethernet, 192.168.1.207 on WiFi)
• Same gateway (192.168.1.1)
• Same DNS servers
• Same routing table and interface metrics
• Same MTU (1500)
• Gateway latency: 1-2ms (ethernet), 3-25ms (powerline) — both well within acceptable range

Impact

Any player whose DNS resolver returns 15.197.149.64 as the first IP for accounts.grpc.ea.com will be unable to connect. DNS ordering can vary based on ISP, geographic location, DNS caching, and network path, making this issue intermittent and difficult for affected players to diagnose.

Suggested Fix

1. Investigate the 15.197.149.64 (AWS Global Accelerator) endpoint — it appears to return different/invalid auth responses compared to the CloudFront endpoint
2. Implement fallback — if the first resolved IP for accounts.grpc.ea.com returns an auth failure, the game should retry with the next DNS result before giving up
3. Verify both endpoints are serving the same gRPC service configuration

Workaround

Adding the following entry to C:\Windows\System32\drivers\etc\hosts forces the working endpoint:

99.83.166.42 accounts.grpc.ea.com

Note: This IP may change over time as CloudFront rotates addresses. This is a temporary workaround only.

Evidence Files

The following packet captures are available to support this report:

• bf6_powerline_20260308_004544.pcapng — Failing connection (powerline path)
• bf6_ethernet_working_20260308_005300.pcapng — Working connection (direct ethernet)
• bf6_wifi_20260308_010049.pcapng — Working connection (WiFi)
• netdiag2_powerline_upstairs_2_20260308_001143.txt — Network diagnostics (powerline)
• netdiag2_ethernet_downstairs_20260308_001524.txt — Network diagnostics (ethernet)