4 ms·
I think DPIs might also be used to detect VPNs. I'm not familiar with VPN traffic patterns situation but I doubt that it's too chaotic or masquerades as somethi
by aasasd 7y ago
I think DPIs might also be used to detect VPNs. I'm not familiar with VPN traffic patterns situation but I doubt that it's too chaotic or masquerades as something else, since VPNs weren't invented with DPI in mind.
Not to imply that GoodbyeDPI assuages all my doubts, either.
- tptacek 7y agoDPI can certainly be used to detect VPNs, but my broader point is, if you want real assurance, you need to get a VPN working; you can't rely on TCP/IP reassembly glitches, because they're largely addressable by the serious DPI vendors.
- windexh8er 7y agoI think it's right to say you can't rely on those older methods, but there has been a lot of research that's gone into DPI bypass. The HTTP Evader work that's been done is particularly good [0]. In some cases the guarantee of operating a VPN over a hostile network isn't guaranteed, especially something like IPsec. So it's good that the simplistic fragmentation methods of tools like fragrouter have been expanded on. [0] https://noxxi.de/research/http-evader.html https://noxxi.de/research/http-evader.html
- tptacek 7y agoThe stuff HTTP Evader is doing is simpler still than the stuff fragrouter (and this tool) does. Middlebox evasion is a cat and mouse game. I'm fine with people playing that game, but not with their lives; if real opsec is on the line, you need a VPN.
- Jordanpomeroy 7y agoSorry, n00b here, but a friend was telling me about a new version of Internet Protocol that fixes man in the middle attacks, like deep packet inspection. Is that realistically coming anytime soon?
- truth_be_told 7y agoIt is an impossibility. Protocols are layered and so at one layer you can add features to detect possible MITM (eg. IPSec, SSL etc.) but cannot always be eliminated. I suggest you consult a book like "The TCP/IP Guide" to get an overview of the main data protocols and how they work. In this day and age, everybody ought to know something about the basic protocols which form the bedrock of our networked society.
- baroffoos 7y agoDetecting VPNs is not an issue in most places since VPNs are allowed.