2026-heitmann-russia-s-early-introduction
findings extracted from this paper
Russia's TSPU devices began dropping all international QUIC traffic on approximately February 26, 2022, coinciding with the full-scale invasion of Ukraine. The filter identified QUIC flows by requiring the first UDP packet destined to port 443 to be at least 1001 bytes and contain the 4-byte QUIC version 1 header (0x00000001); QUIC traffic from Russia to Cloudflare dropped 46% within days. The TSPU maintained 420-second state on the 4-tuple and applied residual censorship to all subsequent packets.
Russia's TSPU devices switched from broad QUIC blocking to SNI-dependent QUIC censorship between May 2022 and July 2023—at least nine months before the GFW introduced SNI-based QUIC censorship, which was previously considered the first of its kind. This transition was discussed only on Russian-language forums (ntc.party) and went unnoticed by the international research community for approximately three years.
Testing the Tranco Top 100k domain list from Russian vantage points shows that all 2,644 domains blocked over TLS SNI are also blocked over QUIC SNI, and domains accessible via TLS are accessible via QUIC—indicating the TSPU maintains a unified SNI blocklist across protocols. Additionally, 31 domain patterns including discord.com exhibit 'residual clearance': QUIC connections to those domains are not censored when immediately preceded by non-censored data on the same 4-tuple; 22 domains are only blocked on port 443.
Reproducing Zohaib et al.'s 10-payload QUIC parser test suite against Russian TSPU devices reveals that the Russian QUIC parser differs meaningfully from the GFW: payload 8 (PING and PADDING frames inserted before the Crypto frame), which circumvents the GFW, does not bypass Russian censorship. Payload 10 (QUICv2) bypasses both censors. Payload 9 (ECH with outer SNI cloudflare-ech.com) is blocked by Russia; payload 3 (version bytes 0x00000002 with invalid MAC) is blocked by both.
As measured from three Russian vantage points in March–April 2026, TSPU devices decrypt QUIC Initial packets, locate the SNI extension in the embedded TLS handshake, and drop packets with forbidden domains plus all subsequent packets on the 4-tuple for 420 seconds (timer resets on each packet). Censorship is unidirectional (outgoing only), covers all destination ports up to 65535 at Saint Petersburg and Novosibirsk (Moscow exempts 22% of system ports 1–1023), and targets only QUICv1—QUICv2 passes uncensored at all vantage points.