HTTP censorship blockpages in Iran fell into two distinct clusters distinguished by IP TTL values: type NTL1 (TTL 53–55) and type NTE1 (TTL 186–188); TCP RST injections targeting TLS and DNS-over-TCP exhibited the same two TTL ranges. The NTL1 injector was absent on June 11 but present on other days, leading the authors to conclude that an entire injector went offline rather than that a single injection pattern was selectively disabled.

After the shutdown lifted (Scan 3), DNS-over-UDP degraded severely — 89.18% of the 9,000 queried domains were affected — but the paper attributes this to general UDP transport instability rather than domain-specific censorship, corroborated by GitHub user reports of ongoing UDP issues. TCP-based protocols (HTTP, TLS) returned to pre-shutdown censorship levels (~15%) in Scan 3, confirming the post-shutdown persistence effect was UDP-specific and not a broadening of the blocklist.

§2.2.4, Table 1 evaluation

In the pre-shutdown scan (Scan 2), Iran's QUIC censorship jumped from 1 domain (0.01%) to 9,000 domains (100%) via complete UDP Initial-packet drops, while DNS-over-TCP censorship spiked from 15.12% to 96.68% of 9,000 queried domains. Both changes preceded the full blackout by roughly 5 days, indicating they were preparatory measures rather than incidental. After the shutdown lifted, QUIC remained 100% blocked while DNS-over-TCP returned to baseline (15.38%).

§2.2, Table 1 evaluation

Iran's June 2025 shutdown was enforced using fine-grained, service-level techniques rather than BGP withdrawals or a single 'big switch' event: individual protocols were selectively blocked before and after the 7-day full blackout (June 18–25), with the total preparation and recovery periods each lasting roughly 4–5 days. Cloudflare Radar showed HTTP traffic reaching near-zero by June 18 but partial recovery already on June 21, while the authors' vantage point (AS57497) remained unreachable until June 25, confirming heterogeneous recovery across Iranian networks.

§2, §3 deployment

The paper demonstrates that two protocol-specific censorship changes — QUIC blocking reaching 100% and DNS-over-TCP blocking reaching 96.68% — both occurred in the scan conducted immediately before Iran's June 18 full blackout, and that similar shutdown preparations were also documented before Iran's January 2026 shutdown. The authors hypothesize that continuous long-term measurement of protocol-specific censorship rates could provide advance warning of impending shutdowns before they come into full effect.

§3, §4 evaluation

Iran's censorship of refraction-networking proxies (Conjure via Psiphon) is not monolithic: different ISPs independently deploy different techniques and timelines. Over 800 million logged Conjure connections from July 2023–February 2025 across 10+ Iranian ASes show TCI (AS58224, ~33% of traffic) uses packet injection, while MCCI/Hamrah-e Avval (AS197207, ~22%) applies IP-based blocking, and some ASes (Parsonline AS16322, Shatel AS31549) show no proxy blocking at all.

2025-alaraj-iran-refraction §4 rst-injectionip-blockingpacket-injectiondpi

The GFI's HTTP and HTTPS filters are now stateful (requiring initial SYN packet with matching sequence numbers) and have been activated on all TCP ports—not only standard ports 80 and 443 as reported by prior studies. This is a significant departure from previous work that found stateless HTTP/HTTPS blocking limited to standard ports. The HTTP filter injects a 403 Forbidden blockpage (not RST packets as used by the GFW), while HTTPS injects a single RST+ACK packet. The GFI also exhibits TCP non-compliance (not requiring a full three-way handshake to trigger filtering), enabling outside-in measurement without in-country servers.

2025-tai-irblock §2.1, §3.2 dpirst-injectionpacket-injectionmiddlebox-interference

Manual analysis of 700+ unique packet groupings from possibly tampered connections yielded 19 high-confidence tampering signatures — up from 6 in prior work — covering 86.9% of all possibly tampered connections. Post-SYN signatures account for 43.2% of possibly tampered connections (99.5% matching a known signature), post-ACK for 16.1% (98.7%), and post-first-data-packet (PSH+ACK) for 5.3% (97.9%), with 19 signatures described as flag-sequence patterns of the form ⟨X→Y⟩ in Table 1.

2023-raman-global §4.1, Table 1 rst-injectionpacket-injectiondpi

The Great Firewall of China does not inject blockpages — it resets connections via TCP RST injection — making it invisible to blockpage-based detection systems. In contrast, the Iran firewall accounted for 97.1% of disruptions observed in Iranian vantage points, and the Bahrain and Saudi Arabia firewalls caused 71.2% and 80.2% of disruptions respectively, all using application-layer blockpage injection.

2020-raman-measuring §V-A-2 rst-injectiondpipacket-injection

By comparing echo-server (bidirectional) versus discard-server (inbound-only) results across 11 censoring countries, Quack finds that only 4 countries (China, Egypt, Jordan, Turkey) also block inbound traffic; the remaining 7 apply DPI exclusively to outbound data. Direction-sensitive blocking is a confirmed capability of deployed middleboxes.

2018-vandersloot-quack §6.3 dpipacket-injectionrst-injection

Censors in Russia, Iran, and India implement all three measured censorship techniques simultaneously: block pages, RST injection, and TTL anomalies. Iran and Cyprus censoring ASes censor content across many URL categories (including General News, Internet Services, Pornography, Gambling), while most other censoring ASes restrict only a few category types.

2017-cho-churn §4, Table 2 rst-injectionpacket-injectiondpi