4 ms·

TCP-level fragmentation for first data packet TCP-level fragmentation for persistent (keep-alive) HTTP sessions Replacing Host header with hoSt Remo

TCP-level fragmentation for first data packet TCP-level fragmentation for persistent (keep-alive) HTTP sessions Replacing Host header with hoSt Removing space between header name and value in Host header Adding additional space between HTTP Method (GET, POST etc) and URI Mixing case of Host header value Very interesting. This is, of course, depending on the DPI-blocking application to be pretty poorly engineered, but I wouldn't be surprised. I'd be interested to see which national DPI solutions (GFC, Russia) this successfully circumvents, not just commercial products.

aasasd 7y ago
I'd also be quite interested in knowing which queries are detected and whether different tools have any effect, but pretty sure that it's a black-box situation where something can be surmised only if the DPI is in the binary mode of ‘block/pass.’ IMO in fact there might be a gray zone of ‘mark this dude as suspicious’ with an unpleasant prospect of future non-digital trouble.
- ValdikSS 7y ago
  >I'd also be quite interested in knowing which queries are detected and whether different tools have any effect For that, I wrote Blockcheck utility to check whether censorship circumvention techniques could be applied on this ISP or not. https://github.com/ValdikSS/blockcheck https://github.com/ValdikSS/blockcheck
darkhorn 7y ago
GoodbyeDPI was working until April this year. After that Turkish Telekоm must have updated its evil softwares because this tool is not useful anymore.
- ValdikSS 7y ago
  I have an experimental version which works with Turk Telecom. Contact me if you want to test it.
tgragnato 7y ago
> TCP-level fragmentation for first data packet && TCP-level fragmentation for persistent (keep-alive) HTTP sessions > I'd be interested to see which national DPI solutions (GFW, Russia) this successfully circumvents The GFW seems to do TCP stream reassembly. I don't think this will work in China.
- ValdikSS 7y ago
  INTANG should work https://github.com/seclab-ucr/INTANG https://github.com/seclab-ucr/INTANG I have plans to implement INTANG methods in GoodbyeDPI, but it requires some architectural changes first. Modern DPIs in Russia also perform stream reassembly or at least have proper state machine, so they can't be circumvented that easily anymore, unfortunately.

aasasd 7y ago

I'd also be quite interested in knowing which queries are detected and whether different tools have any effect, but pretty sure that it's a black-box situation where something can be surmised only if the DPI is in the binary mode of ‘block/pass.’ IMO in fact there might be a gray zone of ‘mark this dude as suspicious’ with an unpleasant prospect of future non-digital trouble.

ValdikSS 7y ago
>I'd also be quite interested in knowing which queries are detected and whether different tools have any effect For that, I wrote Blockcheck utility to check whether censorship circumvention techniques could be applied on this ISP or not. https://github.com/ValdikSS/blockcheck https://github.com/ValdikSS/blockcheck

darkhorn 7y ago

GoodbyeDPI was working until April this year. After that Turkish Telekоm must have updated its evil softwares because this tool is not useful anymore.

ValdikSS 7y ago
I have an experimental version which works with Turk Telecom. Contact me if you want to test it.

tgragnato 7y ago

> TCP-level fragmentation for first data packet && TCP-level fragmentation for persistent (keep-alive) HTTP sessions > I'd be interested to see which national DPI solutions (GFW, Russia) this successfully circumvents The GFW seems to do TCP stream reassembly. I don't think this will work in China.

ValdikSS 7y ago
INTANG should work https://github.com/seclab-ucr/INTANG https://github.com/seclab-ucr/INTANG I have plans to implement INTANG methods in GoodbyeDPI, but it requires some architectural changes first. Modern DPIs in Russia also perform stream reassembly or at least have proper state machine, so they can't be circumvented that easily anymore, unfortunately.