The GFW intermittently drops DNS-resolvable IPs for certain sites at packet-loss rates ranging from 2/10 to 8/10 (measured via tcping), independently of the 180-second residual-censorship window. Some CDN Asia segments are also affected. This behavior varies by province.

Binary search over TTL values is the current practical approach to calibrating TTL-based desync, but it is slow and must be repeated when routes change. China's GFW has at most approximately five international egress points, suggesting that IP-to-egress classification could reduce per-destination probing load, though participants considered this approach impractical to implement reliably.

maoist2009 comment, Jul 2 2025 evaluation

ICMP TTL-exceeded responses provide a faster alternative to binary search for TTL calibration on Linux (without root via gvisorplayground); on Windows, IcmpSendEcho2 or getsockopt(SO_ERROR) can substitute. After the TCP handshake completes, the client can suppress further ICMP error reception to avoid adding latency, as demonstrated in the celzero/firestack split-and-desync implementation.

Lanius-collaris comment Aug 6 2025, maoist2009 comment Jul 2 2025 defense

Residual GFW censorship can be sidestepped during TTL probing by redirecting probe traffic to a different random IP in the same /24 (IPv4) or /64 (IPv6) subnet, or by using plain UDP DNS queries as injection triggers because UDP is stateless and carries no residual censorship. A SYN followed by a PSH+ACK carrying a censored Host header—without completing the full TCP handshake—is sufficient to trigger GFW injection responses.

UjuiUjuMandan comment, Jul 2 2025 defense

TTL-based TCP desynchronization is an effective technique for bypassing the GFW: a fake packet (SYN or data) is crafted with a TTL value small enough to expire before reaching the target server but large enough to pass through all GFW inspection points. The optimal TTL is destination-IP-specific because routes vary by province and ISP—traffic from Shanghai to US exits via the Shanghai GFW, while Hong Kong-bound traffic transits the Guangdong GFW.

Issue body and comments defense

In April 2026, Russia nearly completely blocked Telegram, reducing availability without VPN to 5% during the first ten days; Russia's VPN user base was estimated at no less than 40% of the population. Beginning in mid-April, over 20 major Russian websites and platforms (including Gosuslugi, Ozon, Yandex, Sberbank, VK) began restricting access for VPN users, and Russia introduced a whitelist-based service model permitting only state-approved services under certain network restriction states.

2026-anon-2026-27-vpn §4 (俄罗斯 Telegram / OSW section) ip-blockingdpithrottling

Article 19 documents that Iran's National Information Network (NIN / SHOMA) was designed with explicit reference to China's Great Firewall as a model, with institutional mirroring: Iran's Supreme Council of Cyberspace parallels China's Cyberspace Administration of China, and both governments share a "cyber sovereignty" doctrine used to justify domestic content controls and cross-border technology transfer. The report frames Iran's filtering infrastructure as deliberately architected to replicate GFW capabilities, not as an independently developed system.

2026-article19-tightening-the-net §2, §3 dpisni-blockingdns-poisoningip-blockingbgp-hijackthrottling

Article 19 documents that Iran combines technical filtering with formal coercion of major foreign platforms (including Telegram, Instagram, and WhatsApp) to comply with content removal orders under threat of full blocking. The report notes that Iran's 2022 Women Life Freedom protests accelerated platform blocking when foreign operators refused compliance, demonstrating that the censorship system operates in two modes: coerce-and-allow for compliant platforms, block for non-compliant ones. Domain fronting via these platforms is therefore subject to sudden revocation if political conditions change.

2026-article19-tightening-the-net §6 ip-blockingdns-poisoningthrottling

The April 2026 enforcement cycle created a resource-scarcity feedback loop: upstream providers cut lines with no obligation to refund resellers, newly acquired replacement resources can themselves be reported and cut within days, and stable-resource availability windows are described as "越来越短" (increasingly short) while costs rise concurrently. The overall effect is systemic capacity contraction forecast to continue through at least May 2026.

2026-ermao-april-airport-outage §这轮波动到底发生了什么 / §四月后的趋势判断 ip-blockingasn-blackholingthrottling

After the detection event triggers on Beeline (AS16345), the connection is restricted to exactly one destination: the government-approved MAX messenger (max.ru), while all other Russian domestic whitelist domains (ok.ru, vk.ru, ya.ru, mail.ru) are also blocked. This response is enforced at the ISP/TSPU level and persists until the LTE router is restarted, indicating a stateful per-subscriber penalty state rather than simple packet-level blocking.

2026-gohoski-russia-possible-tun Issue body ip-blockingthrottling

A proposed circumvention technique nests an outbound tunnel inside a legitimate 回国VPN (return-to-China service): the China-IP endpoint of the outer tunnel acts as a relay, with a VPS outside China pushing data back through it in reverse. The theoretical benefit is that 回国VPN services are officially permitted and reportedly not throttled by the GFW.

2026-hellosummer61-possible-exploit-vpn Issue body throttlingip-blocking