2025-maoist2009-better-method-find

Better method to find ttl to bypass gfw automatically?

@maoist2009, @UjuiUjuMandan, @ghost, @Lanius-collaris · net4people/bbs · 2025

Abstract

Community thread discussing TTL-based TCP desynchronization techniques for bypassing the Chinese GFW's multi-layered filtering. Participants exchange practical methods for discovering effective TTL values, including binary search, traceroute analysis, and ICMP-based approaches, while addressing challenges like variable routing paths across provinces and international egress points.

Team notes

Auto-ingested via corpus-crawl. Tags proposed by Claude Haiku 4.5; review and tighten before relying. Practical circumvention engineering; direct application to Lantern's protocol research.

Tags

censors: cn
techniques: packet-injection
defenses: geneva

findings extracted from this paper

Binary search over TTL values is the current practical approach to calibrating TTL-based desync, but it is slow and must be repeated when routes change. China's GFW has at most approximately five international egress points, suggesting that IP-to-egress classification could reduce per-destination probing load, though participants considered this approach impractical to implement reliably.

maoist2009 comment, Jul 2 2025 evaluation dpi cn
The GFW intermittently drops DNS-resolvable IPs for certain sites at packet-loss rates ranging from 2/10 to 8/10 (measured via tcping), independently of the 180-second residual-censorship window. Some CDN Asia segments are also affected. This behavior varies by province.

maoist2009 comment, Jul 2 2025 detection ip-blockingthrottling cn
ICMP TTL-exceeded responses provide a faster alternative to binary search for TTL calibration on Linux (without root via gvisorplayground); on Windows, IcmpSendEcho2 or getsockopt(SO_ERROR) can substitute. After the TCP handshake completes, the client can suppress further ICMP error reception to avoid adding latency, as demonstrated in the celzero/firestack split-and-desync implementation.

Lanius-collaris comment Aug 6 2025, maoist2009 comment Jul 2 2025 defense dpi cn
Residual GFW censorship can be sidestepped during TTL probing by redirecting probe traffic to a different random IP in the same /24 (IPv4) or /64 (IPv6) subnet, or by using plain UDP DNS queries as injection triggers because UDP is stateless and carries no residual censorship. A SYN followed by a PSH+ACK carrying a censored Host header—without completing the full TCP handshake—is sufficient to trigger GFW injection responses.

UjuiUjuMandan comment, Jul 2 2025 defense rst-injectiondpi cn
TTL-based TCP desynchronization is an effective technique for bypassing the GFW: a fake packet (SYN or data) is crafted with a TTL value small enough to expire before reaching the target server but large enough to pass through all GFW inspection points. The optimal TTL is destination-IP-specific because routes vary by province and ISP—traffic from Shanghai to US exits via the Shanghai GFW, while Hong Kong-bound traffic transits the Guangdong GFW.

Issue body and comments defense dpirst-injection cn