流量识别有更新？ CDN + TLS + WS build 已不再可靠。 #2187

swatchion · 2022-11-30T07:17:50Z

swatchion
Nov 30, 2022

近期多事之秋。可以明显感到某墙发威了。

针对域名进行了一系列的识别，当发现有大流量的传输时，会使用 TCP RST packat 重置链接。

大佬们需要针对 CDN + TLS + WS build 做进一步的优化。能力有限，以上仅是推测。

swatchion · 2022-11-30T08:01:43Z

swatchion
Nov 30, 2022
Author

其他的传输层协议如 grpc 、 mkcp 是否可用？

0 replies

cross-hello · 2022-11-30T09:58:32Z

cross-hello
Nov 30, 2022

@swatchion Could you share some packets captured via Wireshark? You could remove server info from pcapng file from using the code of https://github.com/cross-hello/Replace-IP-and-Ethc-mac-in-pcapng-file

0 replies

he583899772 · 2022-11-30T13:36:34Z

he583899772
Nov 30, 2022

vmess+tls+ws 已经不可靠，目前封端口，不管是443，还是其他端口，已经到达分钟级别封

0 replies

cross-hello · 2022-11-30T16:06:42Z

cross-hello
Nov 30, 2022

It must be some misconception inside. All our severs survive at the time.

…

---------------------------------------- *From: *he583899772 ***@***.***> *To: *v2fly/v2ray-core ***@***.***> *CC: *Nanyu ***@***.***>; Comment ***@***.***> *Date: *Nov 30, 2022 13:36:46 *Subject: *Re: [v2fly/v2ray-core] 流量识别有更新？ CDN + TLS + WS build 已不再可靠。 (Discussion #2187)

vmess+tls+ws 已经不可靠，目前封端口，不管是443，还是其他端口，已经到达分钟级别封 — Reply to this email directly, view it on GitHub[#2187 (comment)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYAMGNXWGHFWZ3XVHX3WK5J63ANCNFSM6AAAAAASPJTFGA]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYENM7LP6XBWHDS42YLWK5J63A5CNFSM6AAAAAASPJTFGCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAIE3GQ.gif]Message ID: ***@***.***>

0 replies

cross-hello · 2022-11-30T16:27:50Z

cross-hello
Nov 30, 2022

Based one Encryption method charactics, neural network can't effectively distinguish. (see experiment here: XTLS/Xray-core#1295 (reply in thread) ) So it may be based on packet length combining with time or something others. Not matter what it is, absolutely accurate is impossible. In the high react of blocking it must block other normal service at the same time.

…

---------------------------------------- *From: *he583899772 ***@***.***> *To: *v2fly/v2ray-core ***@***.***> *CC: *Nanyu ***@***.***>; Comment ***@***.***> *Date: *Nov 30, 2022 13:36:46 *Subject: *Re: [v2fly/v2ray-core] 流量识别有更新？ CDN + TLS + WS build 已不再可靠。 (Discussion #2187)

vmess+tls+ws 已经不可靠，目前封端口，不管是443，还是其他端口，已经到达分钟级别封 — Reply to this email directly, view it on GitHub[#2187 (comment)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYAMGNXWGHFWZ3XVHX3WK5J63ANCNFSM6AAAAAASPJTFGA]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYENM7LP6XBWHDS42YLWK5J63A5CNFSM6AAAAAASPJTFGCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAIE3GQ.gif]Message ID: ***@***.***>

0 replies

MakeFortuneQuietly · 2022-12-01T20:05:16Z

MakeFortuneQuietly
Dec 1, 2022

我目前人不在国内，谁能帮测下我的vless+tls+ws+cdn+tor节点？是个人闲置欧服

2 replies

jiangangwu Dec 8, 2022

我可以

MakeFortuneQuietly Dec 9, 2022

订阅
https://dushuxyz.ml/hyperlinks/freedom/vl-sub

swatchion · 2022-12-02T04:06:30Z

swatchion
Dec 2, 2022
Author

if you want to keep your line live long, do not use it for bt download. It works fine before I use it for download. The traffic amount may cause the trigger happened.

…

On Fri, Dec 2, 2022 at 4:05 AM Tracy Tsu ***@***.***> wrote: 我目前人不在国内，谁能帮测下我的vless+tls+ws+cdn+tor节点？是个人闲置欧服 — Reply to this email directly, view it on GitHub <#2187 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFC5QOOI7KC5J5MCX4E6JODWLEAIRANCNFSM6AAAAAASPJTFGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

0 replies

MJamshidnejad · 2022-12-03T13:20:16Z

MJamshidnejad
Dec 3, 2022

Something happened to me too. We need to think about ESNI.

2 replies

kingwilliam Dec 7, 2022

在14億人大國已法規明文絕對禁止 ESNI

MJamshidnejad Dec 11, 2022

Something similar happened here. Any packet which is set up Host or SNI with filtered domain get dropped. However it doesn't happen in local servers....Just mobile and broadband services!

Xyncgas · 2022-12-06T12:12:35Z

Xyncgas
Dec 6, 2022

You don't know why, you don't have packet captured, this is a nothing burger though

0 replies

cross-hello · 2022-12-07T00:16:41Z

cross-hello
Dec 7, 2022

Then what about E(ncrypted) C(lient) H(ello)?

…

---------------------------------------- *From: *kingwilliam ***@***.***> *To: *v2fly/v2ray-core ***@***.***> *CC: *Nanyu ***@***.***>; Comment ***@***.***> *Date: *Dec 7, 2022 00:10:01 *Subject: *Re: [v2fly/v2ray-core] 流量识别有更新？ CDN + TLS + WS build 已不再可靠。 (Discussion #2187)

在14億人大國已法規明文絕對禁止 ESNI — Reply to this email directly, view it on GitHub[#2187 (reply in thread)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AKGBAYF7SURGBNTR4UTWJP3WL7IVRANCNFSM6AAAAAASPJTFGA]. You are receiving this because you commented.[Tracking image][https://github.com/notifications/beacon/AKGBAYH7U3T5BQFTMRSAOM3WL7IVRA5CNFSM6AAAAAASPJTFGCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAIIFPM.gif]Message ID: ***@***.***>

4 replies

kingwilliam Dec 7, 2022

Date: August 07, 2020

en : https://gfw.report/blog/gfw_esni_blocking/en/
cn : https://gfw.report/blog/gfw_esni_blocking/zh/

ESNI:

- We confirm that the Great Firewall (GFW) of China has recently begun blocking ESNI—one of the foundational features of TLS 1.3 and HTTPS.

- 我们确认中国的防火长城（GFW）已经开始封锁ESNI这一TLS1.3和HTTPS的基础特性

ECH:

- As informed by an anonymous reviewer on the riseup pad, the currently deployed ESNI uses extension value 0xffce (see Section 8.1). However, the newer ECH uses extension value 0xff02, 0xff03 and 0xff04(Section 11.1). We confirm no censorship has been observed on these extension values yet.

- 现有的ESNI使用0xffce作为扩展值（详见 Section 8.1）。 但时新的ECH使用0xff02，0xff03和0xff04作为扩展值（Section 11.1). 我们确认这些新的扩展值还未被封锁。

MJamshidnejad Dec 11, 2022

Date: August 07, 2020

en : https://gfw.report/blog/gfw_esni_blocking/en/ cn : https://gfw.report/blog/gfw_esni_blocking/zh/

ESNI:

- We confirm that the Great Firewall (GFW) of China has recently begun blocking ESNI—one of the foundational features of TLS 1.3 and HTTPS.

- 我们确认中国的防火长城（GFW）已经开始封锁ESNI这一TLS1.3和HTTPS的基础特性

ECH:

- As informed by an anonymous reviewer on the riseup pad, the currently deployed ESNI uses extension value 0xffce (see Section 8.1). However, the newer ECH uses extension value 0xff02, 0xff03 and 0xff04(Section 11.1). We confirm no censorship has been observed on these extension values yet.

- 现有的ESNI使用0xffce作为扩展值（详见 Section 8.1）。 但时新的ECH使用0xff02，0xff03和0xff04作为扩展值（Section 11.1). 我们确认这些新的扩展值还未被封锁。

So we've reached a dead end! right?

kingwilliam Dec 11, 2022

i don't think so, just can't use tls 1.3 some special feature

MJamshidnejad Dec 11, 2022

i don't think so, just can't use tls 1.3 some special feature

Do you have any solutions for the problem that I mentioned above? I was thinking about ESNI, but it doesn't seem like a real solution.
#2187 (reply in thread)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

流量识别有更新？ CDN + TLS + WS build 已不再可靠。 #2187

{{title}}

Replies: 10 comments 8 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

流量识别有更新？ CDN + TLS + WS build 已不再可靠。 #2187

Replies: 10 comments · 8 replies

swatchion Nov 30, 2022 Author

swatchion Dec 2, 2022 Author

Replies: 10 comments 8 replies

swatchion
Nov 30, 2022
Author

swatchion
Dec 2, 2022
Author