I absolutely agree that most customers just want to know when the service will be back (an aside: the status checker still says 16 hours, even though we know they're not going to revisit the mast until the 13th!).
I'm not sure that there's much that's wide of the mark. The testing of access via 3G and 4G has been explicit, by selecting 3G or 4G in my CPE. That is, either the tp-link Archer MR600 or the Zyxel LTE3301-PLUS that I have at my disposal. At the moment, there's little point in doing much testing, because we know that the mast is broken and is awaiting replacement parts. 4G doesn't work (reliably), 3G is OK but slow (no surprise).
And I think that if I was in EE's position, I'd be trying to leave the mast running with a QoS to offer the best voice connections, and so what if the data-side is a little slow. I really don't mind that it is broken: but a wee bit of honesty without having to call an obviously already overstretched call centre would make more sense to me.
The routing decisions are interesting. I can understand why a 10.0.0.0/8 address range is chosen over the CGNAT range, if you're looking at sheer numbers. I'm not sure that it's a perfect solution, but it is understandable.
The 11.1.6.254 address in the route fascinates me. Yes, it's possible that EE are bouncing stuff to the US military, and an ARIN search would certainly confirm that the US DoD owns 11.0.0.0/8. But I also wonder whether EE are simply nicking a chunk of a very large public IP range and are using it as a pseudo-private IP range? After all, most of the US military's systems are not publicly routable, so stealing their IP addresses shouldn't cause any issues! At least, you'd hope not.
If I put it all together, my feeling now is that the original slowdown in performance was attributable to failing hardware at the mast. Hopefully, when the replacement parts arrive and the mast gets fixed, the performance will return. And on balance, the likelihood is that the 11.1.6.254 address that appears in the route is from a bit of imaginative IPv4 address management within EE (roll on IPv6!). I can imagine that there might be a Layer 2 shunt from the 10.0.0.0/30 gateway address that is handed out, so that it is a pseudo-private 11.0.0.0/8 addressed router that responds on to the Layer 3 data.
But that's just a theory 😀.
