FINDING · DEFENSE

TLS record fragmentation successfully circumvents the GFW in all tested configurations: splitting the ClientHello across multiple TLS records — whether the split falls before or after the SNI extension — bypasses GFW SNI-based blocking in every case (Table 1). TCP fragmentation after the SNI extension fails, but any TLS-layer fragmentation succeeds.

From 2023-niere-poster — Poster: Circumventing the GFW with TLS Record Fragmentation · §3, Table 1 · 2023 · ACM CCS 2023 (poster)

Implications

Fragment the TLS ClientHello at the TLS record layer so the SNI extension spans multiple records; this defeats the GFW's single-record SNI matcher without requiring TCP-layer manipulation or root privileges.
Combine TLS record fragmentation with TCP fragmentation for defense-in-depth — both layers working together maintain circumvention while adding redundancy against either class of hardening.