The great (fire)wall: the technical details behind how China's internet works
8 hours ago
- #network-security
- #internet-censorship
- #GFW-mechanisms
- China's internet is controlled through the Great Firewall (GFW), which operates using an on-path system that inspects mirrored packets and injects forged responses to block connections.
- The GFW uses three stages: tapping to copy packets without latency, detecting through DPI clusters for content inspection, and injecting spoofed packets like DNS responses or TCP resets.
- Key blocking mechanisms include DNS poisoning to redirect queries, TCP RST injection to terminate connections based on keywords, and SNI filtering for TLS handshakes.
- The GFW evolves in an arms race with circumvention tools, from VPNs to encrypted protocols like Shadowsocks and V2Ray, and now uses ML classifiers to detect traffic patterns.
- Human moderation is essential due to Mandarin's homophones and creative evasion techniques, employing over 100,000 people to manage content on domestic platforms.
- Future trends indicate a shift towards behavioral ML-based classification as encryption technologies like ECH, DoH, and QUIC reduce readable data, pushing for traffic that appears 'statistically boring'.