TTL-based TCP desynchronization is an effective technique for bypassing the GFW: a fake packet (SYN or data) is crafted with a TTL value small enough to expire before reaching the target server but large enough to pass through all GFW inspection points. The optimal TTL is destination-IP-specific because routes vary by province and ISP—traffic from Shanghai to US exits via the Shanghai GFW, while Hong Kong-bound traffic transits the Guangdong GFW.

Binary search over TTL values is the current practical approach to calibrating TTL-based desync, but it is slow and must be repeated when routes change. China's GFW has at most approximately five international egress points, suggesting that IP-to-egress classification could reduce per-destination probing load, though participants considered this approach impractical to implement reliably.

maoist2009 comment, Jul 2 2025 evaluation

The GFW intermittently drops DNS-resolvable IPs for certain sites at packet-loss rates ranging from 2/10 to 8/10 (measured via tcping), independently of the 180-second residual-censorship window. Some CDN Asia segments are also affected. This behavior varies by province.

maoist2009 comment, Jul 2 2025 detection

ICMP TTL-exceeded responses provide a faster alternative to binary search for TTL calibration on Linux (without root via gvisorplayground); on Windows, IcmpSendEcho2 or getsockopt(SO_ERROR) can substitute. After the TCP handshake completes, the client can suppress further ICMP error reception to avoid adding latency, as demonstrated in the celzero/firestack split-and-desync implementation.

Lanius-collaris comment Aug 6 2025, maoist2009 comment Jul 2 2025 defense

Residual GFW censorship can be sidestepped during TTL probing by redirecting probe traffic to a different random IP in the same /24 (IPv4) or /64 (IPv6) subnet, or by using plain UDP DNS queries as injection triggers because UDP is stateless and carries no residual censorship. A SYN followed by a PSH+ACK carrying a censored Host header—without completing the full TCP handshake—is sufficient to trigger GFW injection responses.

UjuiUjuMandan comment, Jul 2 2025 defense

Measurements of TCP RST injectors confirm that GFW II and GFW III consistently yield a seed key k=13, matching TSG's default seed_key parameter in trick_algo_getrandval_with_seed. The probability of sharing TSG's default value of 13 by chance is approximately 10⁻⁴⁴, strongly indicating these GFW components run Geedge Networks TSG code or a close derivative.

2026-ablove-technical-analysis-geedge §6.3, Table 7 rst-injectiondpi

HTTP censorship blockpages in Iran fell into two distinct clusters distinguished by IP TTL values: type NTL1 (TTL 53–55) and type NTE1 (TTL 186–188); TCP RST injections targeting TLS and DNS-over-TCP exhibited the same two TTL ranges. The NTL1 injector was absent on June 11 but present on other days, leading the authors to conclude that an entire injector went offline rather than that a single injection pattern was selectively disabled.

2026-anon-insights-into-iranian §2.2.5 rst-injectionpacket-injectiondpi

FlowPaint evades all three GFW-style rule-based middlebox configurations — stateful TCP keyword reassembler (Censor A), heuristic header filter dropping flows with TCP data offset ≥ 9 (Censor B), and anti-replay validator caching (SEQ, payload_hash) pairs and injecting bidirectional RSTs on replay detection (Censor C). Geneva's duplicate-packet desynchronization strategy fails against Censor C because its malformed artifacts simultaneously satisfy the anti-replay blocking condition, while FlowPaint succeeds by recalculating checksums and injecting no extra packets.

2026-ling-one-prompt-censorship-evasion §5.2, Table 4 dpirst-injectionactive-probing

As of June 2026, Iranian DPI blocking timescales are: CDN-fronted VLESS+WebSocket domains blocked within 24 hours; SSH dynamic port forwarding server IPs blocked within 8 hours; Reality and WireGuard connections blocked immediately (seconds) after handshake completion. This graduated timeline suggests separate fast-path (handshake-pattern) and slow-path (domain reputation / traffic accumulation) detection pipelines operating in parallel.

2026-pooribitwise-iran-advanced-dpi Issue body — combined observations dpisni-blockingip-blockingrst-injectiondns-poisoning

The Reality protocol triggers immediate RST flood responses from Iranian ISP infrastructure at the completion of the TLS handshake, suggesting Iranian DPI has developed a fingerprint or active-probe response specifically targeting Reality's TLS handshake forwarding mechanism as of June 2026.

2026-pooribitwise-iran-advanced-dpi Issue body — Other Observations §2 dpirst-injectiontls-fingerprintactive-probing

Iran's censorship of refraction-networking proxies (Conjure via Psiphon) is not monolithic: different ISPs independently deploy different techniques and timelines. Over 800 million logged Conjure connections from July 2023–February 2025 across 10+ Iranian ASes show TCI (AS58224, ~33% of traffic) uses packet injection, while MCCI/Hamrah-e Avval (AS197207, ~22%) applies IP-based blocking, and some ASes (Parsonline AS16322, Shatel AS31549) show no proxy blocking at all.

2025-alaraj-iran-refraction §4 rst-injectionip-blockingpacket-injectiondpi