FINDING · DETECTION

After a GFW ESNI block is triggered, residual censorship persists for 120–180 seconds (varying by vantage point), blocking all traffic on the same (srcIP, dstIP, dstPort) 3-tuple. Additional ESNI handshakes sent during the residual window do not reset the timer, and it takes at least 1 second for the GFW to enable blocking rules after the triggering packet.

From 2020-gfw-esni-blocking — Exposing and Circumventing China's Censorship of ESNI · Residual Censorship · 2020 · gfw.report

Implications

Circumvention clients that accidentally trigger ESNI blocking must rotate to a new (dstIP, dstPort) pair and wait at least 120 seconds before reusing the original tuple, or use ephemeral source IPs.
The 1-second reaction lag means a single probe followed by rapid port rotation may succeed; build in jitter and tuple randomization to avoid residual censorship accumulation.