FINDING · DETECTION
Port 9001 (Tor) ranked third among all blocked ports in Syria, behind only ports 80 and 443. Proxy SG-48 was responsible for a disproportionate share of Tor censorship — blocking Tor traffic for multiple consecutive days — while other proxies in the same deployment did not, indicating per-proxy policy specialization or traffic steering of suspected circumvention flows to dedicated blocking infrastructure.
From 2014-chaabane-censorship — Censorship in the Wild: Analyzing Internet Filtering in Syria · §4 (Ports), §5.2 · 2014 · Internet Measurement Conference
Implications
- Running Tor bridges on non-standard ports only partially mitigates port-based blocking; traffic steering to specialized blocking proxies (as seen on SG-48) suggests the censor can route suspicious flows independently of port.
- Bridges and pluggable transports should blend into ports 80/443 traffic, as those dominate both allowed and censored traffic and offer the largest cover population.
Tags
Extracted by claude-sonnet-4-6 — review before relying.