FINDING · DETECTION
The computational cost of decrypting QUIC Initial packets limits the GFW's throughput: blocking effectiveness drops measurably as cross-border QUIC traffic increases and exhibits a diurnal pattern, falling during China's peak traffic hours. In a controlled experiment, sending QUIC Initial packets at 100–1500 kpps (TTL-limited so they reach the GFW but not end-hosts) caused GFW censorship effectiveness to decrease monotonically with sending rate, while equal-rate random-payload UDP traffic produced no such degradation—confirming the bottleneck is QUIC decryption, not raw bandwidth. A related availability attack using IP-spoofed QUIC Initials from one machine can cause the GFW to drop all UDP traffic between arbitrary Chinese hosts and any foreign endpoint for the 180-second residual window.
From 2025-zohaib-quic-sni — Exposing and Circumventing SNI-based QUIC Censorship of the Great Firewall of China · §3.4 / §5 · 2025 · USENIX Security
Implications
- QUIC-based circumvention tools benefit from high-traffic periods (Chinese peak hours) as natural cover; schedule high-value sessions accordingly or implement client-side adaptive retry during peak windows.
- The 180-second residual blocking window and decryption bottleneck mean that a modest decoy-traffic injection ahead of a real connection may statistically bypass the censor without requiring protocol changes.
- Monitor GFW QUIC blocking rates as a signal; persistent <100% blocking rates indicate the censor is CPU-bound and more aggressive fragmentation or volume may further degrade it.
Tags
Extracted by claude-sonnet-4-6 — review before relying.