Internet analysis in the shutdown in iran

For non-whitelisted SNIs connecting to allowed Cloudflare IPs, Iran's DPI enforced a strict 6-packet limit per connection, sufficient only to load a webpage but not to sustain any tunnel; connections bearing a whitelisted SNI were unrestricted. Outside DNS providers were blocked within one to two weeks and replaced with a local DNS infrastructure that operated at a maximum of ~100 KB/s with connections dropping at approximately the one-minute mark.

Issue body deployment sni-blockingdpithrottlingdns-poisoning ir

Iran implemented a per-connection packet quota tied to SNI whitelisting: connections whose SNI was not on the approved list were classified as 'grey' and hard-limited to exactly 6 packets before DPI terminated the session. Connections presenting a whitelisted SNI were passed without a packet cap.

Issue body (SNI whitelisting paragraph) detection dpisni-blocking ir

DNS tunneling operated for 'at most a week or two' before Iran blocked all external DNS resolvers and forced traffic to local DNS providers. The local DNS infrastructure was effectively unusable as a tunneling substrate: maximum throughput was ~100 kb/s and connections were reliably severed around the 1-minute mark.

Issue body (DNS paragraph) evaluation dns-poisoning ir

During the 2026 Iranian internet shutdown, nearly all IP addresses were fully blocked; a small subset of Cloudflare IPs completed TCP three-way handshakes (SYN-ACK returned) but DPI terminated sessions before any data transfer, confirming that the primary enforcement mechanism was payload-level DPI rather than IP-layer blocking alone.

Issue body deployment dpiip-blocking ir

After approximately four days, Iran placed Cloudflare IP ranges behind a NAT that performed full TCP reassembly with strict checksum and sequence-number validation; any packet with an incorrect checksum or out-of-window sequence number caused immediate connection teardown, eliminating both TTL-spoofing and sequence-desynchronization bypasses.

Issue body deployment sni-blockingdpimiddlebox-interference ir

During full Iranian blackouts, WebRTC and all UDP/QUIC traffic were completely blocked. DNS-over-QUIC (DoQ) could complete a handshake but the censor severed the connection after a single post-handshake data packet, rendering it unusable for tunneling.

Issue body (WebRTC/UDP paragraph) detection http3-quic-blockport-blocking ir

Two TCP-layer SNI-spoofing techniques briefly circumvented Iran's DPI for approximately four days: (1) sending a fake ClientHello with a TTL too low to reach the server but high enough to pass the censor, and (2) sending a fake ClientHello at a future TCP sequence number that the server would ignore but the stateless DPI would accept. Both were defeated once Iran placed Cloudflare IPs behind a stateful NAT that validated checksums and sequence numbers. Iran's SNI whitelist permitted only specific domains, hcaptcha.com among them.

Issue body (SNI spoofing methods paragraph) defense dpisni-blockingmiddlebox-interference ir