4 ms·
So does the Great Firewall do deep packet inspection? I take it that it does, and blocks any protocols that it detects that allow tunneling/traversing the firew
by Severian 9y ago
So does the Great Firewall do deep packet inspection? I take it that it does, and blocks any protocols that it detects that allow tunneling/traversing the firewall.
What if there was a method of changing the standard data formats to be randomized based on one time authorization codes? So your SSH/SSL/L2TP/etc was mangled around to something corresponding to a one time auth function. Basically pre-encrypting or obfuscating to avoid the deep packet inspection.
- robert_foss 9y agoHave a look into the arms race between the Tor project and the Great Firewall of China.
- yoran 9y agoRelated to this, this an interesting paper that clarifies how the Great Firewall discovers Tor nodes by doing active probing: https://nymity.ch/active-probing/imc2015.pdf https://nymity.ch/active-probing/imc2015.pdf. No deep packet inspection is necessary when you pretend to be a Tor user and can identify the typical response for a Tor node.
- swiley 9y agoPerhaps this could be defended against by probabilistic connection rejection?
- ethbro 9y agoFor anyone in on this, would be absolutely fascinated by any good, recent(ish) links where this is documented or discussed. And hats off to the Tor people and all the good work they're doing there.
- KGIII 9y agoWhen you have the data about a lot of normal traffic, you can easily spot the abnormal traffic. Then, slow it down or stop it. False positives aren't a huge priority, I don't imagine.