REALITY ('certificate stealing') had produced no large-scale GFW blocking reports as of November 2024, per Xray-core developer @RPRX. Its operational downside is lower throughput compared to aggressive packet-dispatch protocols like Hysteria 2.

CDN-based proxy protocols avoid permanent IP-level GFW blocking but suffer from instability. IPLC ('no wall crossing') leased lines are stable and fast but expensive and subject to periodic administrative disconnection by the Chinese communications regulator.

Comment by @RPRX, Nov 18 2024 evaluation

Hysteria 2 (QUIC-based proxy) suffered past large-scale GFW blocking events but was broadly functional as of late 2024. Aggressive packet sending causes VPS providers and ISPs—not the GFW itself—to apply rate limits, adding a second failure mode beyond censor detection.

Comment by @RPRX, Nov 18 2024 evaluation

Raw UDP P2P gaming traffic was detected and blocked within 1–2 hours. Hysteria 2 port-hopping delayed blocking but the entire server IP was eventually blacklisted once enough ports were consumed. The reporter identified udp2raw + WireGuard (with udpspeeder for packet loss compensation) as the most stable high-performance solution.

Comment by @iopq, Dec 1 2024 deployment

XTLS Vision has never triggered large-scale GFW blocking; one user reports 2.5+ years of uninterrupted use. Developers acknowledge that Vision without Seed produces fixed, distinguishable traffic characteristics and are developing 'Vision Seed' to introduce per-session randomization.

Comments by @RPRX and @terada46, Nov 18–20 2024 evaluation

The blog author, drawing on evaluation experience, concludes that LetsVPN's failure was not caused by IP exhaustion or ordinary node instability but by precise protocol-signature identification: once the GFW extracts a client handshake feature, it can simultaneously block all connections sharing that signature across hundreds of thousands of users.

2026-anon-letsvpn-vpn §公告里的几句大实话 dpitls-fingerprintactive-probing

The Reality protocol triggers immediate RST flood responses from Iranian ISP infrastructure at the completion of the TLS handshake, suggesting Iranian DPI has developed a fingerprint or active-probe response specifically targeting Reality's TLS handshake forwarding mechanism as of June 2026.

2026-pooribitwise-iran-advanced-dpi Issue body — Other Observations §2 dpirst-injectiontls-fingerprintactive-probing

Authoritarian regimes blocked Snowflake primarily through DPI targeting fingerprints in Pion's DTLS handshake and TLS fingerprints in complementary WebRTC protocols, not through ML-based traffic analysis — confirming that cost-effective censors consistently favor simple, deterministic methods over computationally expensive classifiers.

2026-vilalonga-obscura-enabling-ephemeral §1 dpitls-fingerprintactive-probing

TLS-Attacker's Workflow Traces and Modifiable Variables mechanisms allow testers to specify arbitrary protocol flows and apply field-level modifications — including adding, removing, or overwriting individual TLS message fields — without breaking the internal TLS state machine. This makes it the standard instrument for probing how DPI systems and active-probing detectors respond to non-standard or mutated TLS handshakes.

2024-niere-tls-attacker §1 Introduction tls-fingerprintactive-probingdpi

ShadowTLS relays are detectable via three active probing techniques exploiting behavioral discrepancies from the mask sites they mimic: (1) responding to plaintext HTTP on port 443 with FIN-ACK rather than an error (only 17% of TLS servers share this behavior), (2) silently ignoring non-TLS record data post-handshake rather than sending a fatal alert (only 0.14% of 30M hosts behaved this way), and (3) silently ignoring corrupted TLS Application Data records rather than sending a bad_record_mac alert (only 0.12% of hosts silent).

2023-wang-chasing §3.2 active-probingtls-fingerprintdpi

77% of public bridges offer only vanilla Tor, which is trivially detectable via TLS certificate pattern matching. An additional 15% offer Pluggable Transports with conflicting security properties (e.g., obfs4 + obfs3 + obfs2 co-deployed on the same bridge), allowing a censor to confirm and block the bridge via the weakest PT and thereby disable all stronger PTs on the same IP — including active-probing-resistant transports like obfs4 and ScrambleSuit.

2017-matic-dissecting §V-C, Table I tls-fingerprintactive-probingdpi