2 ms·

Having worked on a library that was often used in DPI (security systems, not national-level censorship stuff, although after open-sourcing we lost the power to

Having worked on a library that was often used in DPI (security systems, not national-level censorship stuff, although after open-sourcing we lost the power to discriminate) I would not imagine that simple fragmentation, insertion of spaces nor mixed-case would do all that much to slow down a well-written DPI system. I suspect more elaborate evasions might necessary - e.g. tcp fragmentation with inconsistent fragments where the understanding of which final 'reassembly' the target gets is necessary to understand what the DPI system is seeing. This might also ring alarm bells at the intermediate firewall, though. The problem is with the censorship firewalls is that they can just throw stuff on the floor if they feel a bit suspicious about it; they can be inherently 'worse' in their liveness guarantees than, say, a corporate DPI product.

ValdikSS 7y ago
In Russia, DPI systems which are used for censorship generally prevent accessing only blocked domain names or exact HTTP URLs. There's no proxy or VPN censorship in place, so unknown protocols are not getting discarded. We still don't have national-wide firewall like that in China, each ISP (and we have 1000+ of them) performs censorship using either dumb IP blackholing (breaks a lot of legitimate stuff), on-path DPI (I call it "passive" in GoodbyeDPI, DPI which receive mirrored traffic and can only inject something but not prevent the connectivity per se), in-path DPI (DPI as a router/bridge). Most DPI systems in Russia were specifically created for Russian censorship (i.e. capable only for HTTP URL and TLS SNI introspection), from scratch. Some ISP have their own in-house DPI systems. These systems were just not designed to handle packets fragmented on TCP or IP level at the beginning, because it's rarely the case in the real world. If you want to learn more, visit internet censorship forum I created. I write about different DPI systems there and trying to document internet censorship in Russia as a whole. https://ntc.party/c/internet-censorship-all-around-the-world/russia https://ntc.party/c/internet-censorship-all-around-the-world...

ValdikSS 7y ago

In Russia, DPI systems which are used for censorship generally prevent accessing only blocked domain names or exact HTTP URLs. There's no proxy or VPN censorship in place, so unknown protocols are not getting discarded. We still don't have national-wide firewall like that in China, each ISP (and we have 1000+ of them) performs censorship using either dumb IP blackholing (breaks a lot of legitimate stuff), on-path DPI (I call it "passive" in GoodbyeDPI, DPI which receive mirrored traffic and can only inject something but not prevent the connectivity per se), in-path DPI (DPI as a router/bridge). Most DPI systems in Russia were specifically created for Russian censorship (i.e. capable only for HTTP URL and TLS SNI introspection), from scratch. Some ISP have their own in-house DPI systems. These systems were just not designed to handle packets fragmented on TCP or IP level at the beginning, because it's rarely the case in the real world. If you want to learn more, visit internet censorship forum I created. I write about different DPI systems there and trying to document internet censorship in Russia as a whole. https://ntc.party/c/internet-censorship-all-around-the-world/russia https://ntc.party/c/internet-censorship-all-around-the-world...