Binary search over TTL values is the current practical approach to calibrating TTL-based desync, but it is slow and must be repeated when routes change. China's GFW has at most approximately five international egress points, suggesting that IP-to-egress classification could reduce per-destination probing load, though participants considered this approach impractical to implement reliably.

The GFW intermittently drops DNS-resolvable IPs for certain sites at packet-loss rates ranging from 2/10 to 8/10 (measured via tcping), independently of the 180-second residual-censorship window. Some CDN Asia segments are also affected. This behavior varies by province.

maoist2009 comment, Jul 2 2025 detection

ICMP TTL-exceeded responses provide a faster alternative to binary search for TTL calibration on Linux (without root via gvisorplayground); on Windows, IcmpSendEcho2 or getsockopt(SO_ERROR) can substitute. After the TCP handshake completes, the client can suppress further ICMP error reception to avoid adding latency, as demonstrated in the celzero/firestack split-and-desync implementation.

Lanius-collaris comment Aug 6 2025, maoist2009 comment Jul 2 2025 defense

Residual GFW censorship can be sidestepped during TTL probing by redirecting probe traffic to a different random IP in the same /24 (IPv4) or /64 (IPv6) subnet, or by using plain UDP DNS queries as injection triggers because UDP is stateless and carries no residual censorship. A SYN followed by a PSH+ACK carrying a censored Host header—without completing the full TCP handshake—is sufficient to trigger GFW injection responses.

UjuiUjuMandan comment, Jul 2 2025 defense

TTL-based TCP desynchronization is an effective technique for bypassing the GFW: a fake packet (SYN or data) is crafted with a TTL value small enough to expire before reaching the target server but large enough to pass through all GFW inspection points. The optimal TTL is destination-IP-specific because routes vary by province and ISP—traffic from Shanghai to US exits via the Shanghai GFW, while Hong Kong-bound traffic transits the Guangdong GFW.

Issue body and comments defense

During the June 2025 Iran shutdown, circumvention tool performance diverged sharply by transport design. Psiphon's multi-protocol architecture sustained 1.5 million concurrent users—roughly one-third of its normal Iranian base. Lantern's "proxyless" protocol (domain-fronting via CDN, ~40% of Lantern's Iranian traffic) showed moderate success. Tor usage collapsed during the blackout but bridge connections surged and rebounded quickly after lifting. BeePass (serving 500k+ daily users at shutdown onset) used live A/B testing of port/obfuscation-prefix combinations to probe the censors' blocking parameters in real time. The Ceno Browser's P2P network grew from 600 active peers on June 13 to ~8,000 by July 11, indicating that decentralized fallback paths stayed up even during peak blocking.

2025-iran-shutdown-measurement §Tool Performance dpithrottling

The June 2025 Iran shutdown—carried out during the Iran-Israel war beginning ~June 19—did not use BGP route withdrawals as in 2019. Instead, authorities applied service-level restrictions at the national border: DNS poisoning of foreign destinations, protocol whitelisting permitting only pre-approved domestic services, and DPI to block circumvention-tool traffic. Iran's international traffic fell roughly 90% while the country's BGP routes remained advertised, making the shutdown invisible to BGP-based monitoring systems. OONI measurement volume, which totalled 121,333 in June 2025, collapsed to under 200 submissions on June 19-20.

2025-iran-shutdown-measurement Executive Summary / §2 dpidns-poisoningport-blockingip-blocking

During the June 2025 shutdown, Iranian authorities blocked international One-Time Password (OTP) SMS delivery, preventing new sign-ins to foreign secure-messaging platforms and VPN services. This forced users toward government-approved domestic platforms that lack security and privacy protections. The blockade of OTPs effectively weaponized account-recovery flows as a secondary shutdown layer, disproportionately affecting users who needed to activate new circumvention tools during the crisis.

2025-iran-shutdown-measurement §Human Rights Implications port-blockingdpikeyword-filtering

Input blocking in Chinese LLM services (DeepSeek, Qwen, Kimi, Doubao) is overwhelmingly consistent: all four services persistently block the exact same queries across all 5 measurement samples in both Simplified and Traditional Chinese. Output blocking is far less consistent, with only 29 out of 349 output-blocked queries blocked across all 5 samples. Baidu-Chat is exceptional: it performs almost no input blocking but instead relies heavily on post-search and output blocking (78.6% of blocks are output-phase).

2026-ablove-characterizing §VI-B keyword-filteringdpi

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

Measurements of TCP RST injectors confirm that GFW II and GFW III consistently yield a seed key k=13, matching TSG's default seed_key parameter in trick_algo_getrandval_with_seed. The probability of sharing TSG's default value of 13 by chance is approximately 10⁻⁴⁴, strongly indicating these GFW components run Geedge Networks TSG code or a close derivative.

2026-ablove-technical-analysis-geedge §6.3, Table 7 rst-injectiondpi